GPU VulnDB

Database/Firmware, BMC & network fabric

Intel Ethernet Adapter manageability firmware (NC-SI / sideband path): Improper input validation in the *manageability*

CVSS 8.6CVE-2021-33141Firmware, BMC & network fabriccurated

Impact

Improper input validation in the *manageability* firmware of Intel Ethernet adapters, exploitable by an unauthenticated user. Manageability firmware is the NC-SI sideband engine — the path that carries BMC traffic over the same physical NIC as production data. A flaw there is the bridge between the data network and out-of-band management: an attacker on the fabric reaches the sideband channel, and the sideband channel reaches the BMC, which controls power and virtual media for the node. This is the highest-value shape of NIC firmware bug for a multi-tenant operator, because it crosses the boundary between 'tenant network' and 'operator management plane'.

Who can reach it

Unauthenticated attacker with network access to the adapter. No host account required.

What to do

Flash adapter manageability firmware via the OEM firmware bundle (this is separate from the main NVM image on some platforms); cold power cycle. Architecturally, the durable control is to stop sharing the production NIC with BMC traffic — use a dedicated BMC NIC on a physically separate OOB network rather than NC-SI sideband. That is a hardware/topology decision, so it applies to your next buildout, not this one. Companion issues in the same advisory family: CVE-2021-33162, CVE-2021-33161, CVE-2021-33158, CVE-2021-33157, CVE-2022-37341.

References

https://nvd.nist.gov/vuln/detail/CVE-2021-33141https://nvd.nist.gov/vuln/detail/CVE-2021-33162

Related entries

All Firmware, BMC & network fabric entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.