Intel Ethernet Adapter manageability firmware (NC-SI / sideband path): TENANT ISOLATION: improper input validation

Impact

TENANT ISOLATION: improper input validation in the *manageability* firmware of Intel Ethernet adapters, exploitable by an unauthenticated user. Manageability firmware is the NC-SI sideband engine — the path that carries BMC traffic over the same physical NIC as production data. A flaw there is the bridge between the data network and out-of-band management: an attacker on the fabric reaches the sideband channel, and the sideband channel reaches the BMC, which controls power and virtual media for the node. This is the highest-value shape of NIC firmware bug for a multi-tenant operator, because it crosses the boundary between 'tenant network' and 'operator management plane'.

Who can reach it

Unauthenticated attacker with network access to the adapter. No host account required.

What to do

Flash adapter manageability firmware via the OEM firmware bundle (this is separate from the main NVM image on some platforms); cold power cycle. Architecturally, the durable control is to stop sharing the production NIC with BMC traffic — use a dedicated BMC NIC on a physically separate OOB network rather than NC-SI sideband. That is a hardware/topology decision, so it applies to your next buildout, not this one. Companion issues in the same advisory family: CVE-2021-33162, CVE-2021-33161, CVE-2021-33158, CVE-2021-33157, CVE-2022-37341.

References