AMI MegaRAC SPx 12 / SPx 13 (BMC network service): Stack memory corruption in the same unauthenticated BMC parsing

Impact

Stack memory corruption in the same unauthenticated BMC parsing surface. Best case for the attacker is BMC code execution and a firmware-level foothold on the node; worst case for the operator without an exploit is a BMC that wedges and needs a physical AC cycle to recover, which on a dense GPU rack means a hands-on trip and possibly draining neighbouring nodes.

Who can reach it

Adjacent network, no credentials, high complexity. Anything on the management VLAN - including a compromised BMC on a neighbouring node - is close enough.

What to do

Firmware flash to SPx_12.7 / SPx_13.6. Out-of-band, per node, ODM-gated. No config-only fix inside the BMC; the compensating control is to make the management VLAN unreachable from tenant and general corporate networks and to keep the BMC off any routable address space.

References