Intel OpenBMC firmware (before version 0.72) - network-facing service: An unauthenticated caller reads out of bounds

CVSS 7.5CVE-2022-35729Firmware, BMC & network fabricINTEL-SA-00737curated

Impact

An unauthenticated caller reads out of bounds and crashes the BMC. Intel shipped this in the same SA-00737 bundle as the OpenBMC IPMI authentication bypass, which is the useful context: Intel-badged OpenBMC below 0.72 carried both a pre-auth takeover and a pre-auth crash at the same time. Losing the BMC on Intel-platform GPU nodes means losing remote power and console; an attacker who wants an operator blind while working on hosts starts here.

Who can reach it

Unauthenticated, over the network, against the BMC management interface.

What to do

Fixed in Intel OpenBMC 0.72 and later - a BMC firmware update per node, out-of-band, through Intel's platform update packages. If you are on an affected Intel platform you are almost certainly also exposed to CVE-2021-39296 from the same advisory, so treat this as one campaign rather than two. Config-only first move remains the same: ACL the management network and disable IPMI over LAN.

References

https://nvd.nist.gov/vuln/detail/CVE-2022-35729 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00737.html

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.