Intel Server OpenBMC firmware (before egs-1.09) - authentication logic: An authenticated low-privilege user escalates

Impact

An authenticated low-privilege user escalates privilege on the BMC, with a scope change - the escalation crosses a security boundary rather than staying inside the account model. On fleets that hand out constrained BMC accounts to tenants, support staff or monitoring systems (read-only sensor scraping is a common one), this converts any of those accounts into something with more control over the node. The lesson for a GPU operator: a read-only BMC account issued to a customer or a monitoring vendor is not a safe thing to hand out on this firmware.

Who can reach it

Local access with a low-privileged authenticated BMC account. Needs an existing credential, so exposure tracks how widely you distribute BMC accounts.

What to do

Fixed in Intel Server OpenBMC egs-1.09 and later; delivery is a per-node out-of-band BMC firmware update through Intel's platform packages, with the usual OEM rebase lag on non-Intel-badged boards using the same base. Config-only compensation: stop issuing BMC accounts to third parties, proxy sensor and telemetry reads through your own collector rather than giving monitoring vendors direct BMC credentials.

References