ASPEED AST2400 / AST2500 BMC SoC: Arbitrary read/write of the BMC's entire physical address space from the host CPU

CVSS 9.8CVE-2019-6260Firmware, BMC & network fabricPantsdowncurated

Impact

Arbitrary read/write of the BMC's entire physical address space **from the host CPU** — host-to-BMC boundary collapse. A tenant with host root can implant the BMC; survives reimaging and node reallocation

Who can reach it

Local, from the host OS via iLPC2AHB / PCIe VGA / X-DMA bridges

What to do

Fix is a BMC firmware build that disables the AHB bridges (OpenBMC has it; many ODM builds do not). On multi-tenant bare metal this is the single most important control — otherwise every tenant handoff is a potential persistent implant

Fleet impact

How widespread

universal - ASPEED is effectively the sole-source BMC SoC in x86 server boards, including GPU servers

Cost to remediate

firmware-flash per node; on some boards the only mitigation is disabling the LPC/PCIe P2A bridges in an OEM image respin, and several SKUs remain unpatchable-mitigate-only

Why it hits the whole fleet

Host-side root can read/write the BMC's entire physical address space over LPC/PCIe, so any tenant that gets host root pivots into the always-on management processor - below the hypervisor, persistent across reimaging, on every node of an ASPEED-based fleet.

References

https://nvd.nist.gov/vuln/detail/CVE-2019-6260

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.