Broadcom Emulex HBA Manager / OneCommand Manager (Fibre Channel and FC-NVMe HBAs), before 11.4.425.0 and 12.8.542.31

Impact

Unless the agent was installed in Strictly Local Management mode, the Emulex management daemon accepts unauthenticated remote commands. Two of them matter: the remote firmware-download path has a buffer overflow reachable pre-auth, and the same path lets an attacker place or replace an arbitrary file on the host. That is remote, unauthenticated code execution on the host plus a direct route to writing HBA firmware. An Emulex HBA is a PCIe device with DMA and its own processor that owns the node's path to shared storage - firmware planted there survives an OS reimage and can silently mirror or corrupt a later tenant's FC traffic. The companion GetDumpFile issues additionally let an unauthenticated caller pull arbitrary files off the host.

Who can reach it

Any host that can reach the HBA Manager remote management listener on the host's management interface. No credentials in non-secure (default remote) mode. This listener frequently ends up on the same flat provisioning VLAN as the BMCs.

What to do

Upgrade HBA Manager to 11.4.425.0 or 12.8.542.31 and above on every host with an Emulex HBA. The stronger and faster fix is to reinstall the agent in Strictly Local Management mode, which removes the remote listener entirely and leaves only local hbacmd - do this by default on bare-metal tenant nodes, since remote HBA management is rarely worth the exposure. Neither step requires an HBA firmware flash or an array outage; it is an agent reinstall and service restart. If a node was exposed, treat the HBA firmware as untrusted and reflash from the vendor image before returning it to the pool.

References