Broadcom LSA / Intel RWC3: insecure folders created by the web GUI allow escalation to root

CVSS 9.8CVE-2023-4341Firmware, BMC & network fabriccurated

Impact

The LSA web GUI creates folders with insecure permissions, and this can be used to escalate to root on the host. LSA is installed by OEM tooling on servers that carry a Broadcom/LSI RAID controller, so this is a root path on bare-metal nodes that a non-root foothold can take. Root on a GPU node means control of every tenant workload on it and of the RAID controller underneath. The record does not name the folders or the exact mechanism.

Who can reach it

A local user or process on the host that can write into the folders LSA creates. Local access is implied by the privilege-escalation description even though the record's vector says network.

What to do

Upgrade LSA / Intel RWC3 to the fixed release in Intel SA-00926 and restart the LSA service. OEM-rebadged builds can lag behind upstream, so confirm the version your server vendor actually ships. If LSA is not used, uninstalling it removes the exposure. No reboot is described.

References

https://nvd.nist.gov/vuln/detail/CVE-2023-4341 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00926.html https://www.broadcom.com/support/resources/product-security-center

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.