HPE ProLiant Gen10 System ROM (security restriction bypass): A local bypass of security restrictions in the System ROM

Impact

A local bypass of security restrictions in the System ROM (BIOS) of ProLiant DL20 Gen10, ML30 Gen10 and MicroServer Gen10 Plus. Firmware-level restriction bypasses matter more than their score suggests, because the restrictions being bypassed are the ones enforcing secure configuration at boot - and anything an attacker changes there persists across OS reinstalls. These are edge and utility SKUs rather than GPU nodes, but they are the boxes that end up as bastion hosts, PXE servers and DHCP/DNS for a GPU cluster, which makes them a useful staging point.

Who can reach it

Local to the host with elevated privileges - an administrator-level account on the operating system, or physical access during maintenance. Not reachable from the management VLAN.

What to do

Update the System ROM to v2.52 or later. Unlike an iLO flash, a System ROM update only takes effect on the next host reboot, so it needs a maintenance window per node - though for this SKU set that is far cheaper than draining a GPU node. Stage the ROM through iLO or Service Pack for ProLiant and let it apply at the next scheduled restart. No config-only mitigation.

References