Intel Server OpenBMC firmware (before egs-1.09) - authentication logic: An authenticated low-privilege user escalates

CVSS 5.2CVE-2023-31189Firmware, BMC & network fabricINTEL-SA-00922curated

Impact

An authenticated low-privilege user escalates privilege on the BMC, with a scope change - the escalation crosses a security boundary rather than staying inside the account model. On fleets that hand out constrained BMC accounts to tenants, support staff or monitoring systems (read-only sensor scraping is a common one), this converts any of those accounts into something with more control over the node. The lesson for a GPU operator: a read-only BMC account issued to a customer or a monitoring vendor is not a safe thing to hand out on this firmware.

Who can reach it

Local access with a low-privileged authenticated BMC account. Needs an existing credential, so exposure tracks how widely you distribute BMC accounts.

What to do

Fixed in Intel Server OpenBMC egs-1.09 and later; delivery is a per-node out-of-band BMC firmware update through Intel's platform packages, with the usual OEM rebase lag on non-Intel-badged boards using the same base. Config-only compensation: stop issuing BMC accounts to third parties, proxy sensor and telemetry reads through your own collector rather than giving monitoring vendors direct BMC credentials.

References

https://nvd.nist.gov/vuln/detail/CVE-2023-31189 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00922.html

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.