Database/Firmware, BMC & network fabric
ASPEED AST2400 / AST2500 BMC SoC: Arbitrary read/write of the BMC's entire physical address space **from the host CPU**
Impact
Arbitrary read/write of the BMC's entire physical address space **from the host CPU** — host-to-BMC boundary collapse. A tenant with host root can implant the BMC; survives reimaging and node reallocation
Who can reach it
Local, from the host OS via iLPC2AHB / PCIe VGA / X-DMA bridges
What to do
Fix is a BMC firmware build that disables the AHB bridges (OpenBMC has it; many ODM builds do not). On multi-tenant bare metal this is the single most important control — otherwise every tenant handoff is a potential persistent implant
Fleet impact
How widespread
universal - ASPEED is effectively the sole-source BMC SoC in x86 server boards, including GPU servers
Cost to remediate
firmware-flash per node; on some boards the only mitigation is disabling the LPC/PCIe P2A bridges in an OEM image respin, and several SKUs remain unpatchable-mitigate-only
Why it hits the whole fleet
Host-side root can read/write the BMC's entire physical address space over LPC/PCIe, so any tenant that gets host root pivots into the always-on management processor - below the hypervisor, persistent across reimaging, on every node of an ASPEED-based fleet.
References
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.