Broadcom LSA / Intel RWC3: session data written to log files allows privilege escalation

CVSS 9.8CVE-2023-4340Firmware, BMC & network fabriccurated

Impact

LSA prints session information into its log file. Anyone who can read that log can take over the session and gain LSA's privileges. LSA runs privileged on every server with a Broadcom/LSI RAID controller and can rebuild or delete virtual drives under running workloads. On a bare-metal GPU node, a low-privilege foothold such as a container escape or a compromised monitoring agent becomes control of the storage controller. The record does not say whether the log is readable remotely or only locally.

Who can reach it

Anyone who can read the LSA log files on the host. The record does not say how they are exposed. No LSA credentials are needed once a logged session is recovered.

What to do

Upgrade LSA / Intel RWC3 to the fixed release in Intel SA-00926 and restart the LSA service. After patching, purge or rotate the existing LSA logs and invalidate active sessions: logs written before the patch still hold usable session data. No reboot or array impact is described.

References

https://nvd.nist.gov/vuln/detail/CVE-2023-4340 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html https://www.broadcom.com/support/resources/product-security-center

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.