ASPEED video engine capture driver (drivers/media/platform/aspeed) - iKVM path: The video engine writes past

Impact

The video engine writes past its capture buffer when the host is driving a 1600x900 mode, corrupting whatever BMC kernel memory sits after it. The reported repro is mundane: run iKVM with virtual media mounted while the BMC is under memory pressure. Since the resolution is chosen by the host, a tenant with control of the server's display output can steer the BMC into the corrupting mode on demand. Realistically this is a BMC crash - which on a GPU node means losing remote power control and console right when you need it - but out-of-bounds writes driven by attacker-chosen geometry are the raw material for something worse.

Who can reach it

The host side picks the video mode, so any tenant with root on the bare-metal node can select it. Triggering the corruption additionally needs the BMC's iKVM/video capture to be running, which is the normal state on fleets that leave remote console available.

What to do

Kernel fix backported into stable; reaching your fleet means a BMC firmware flash per node, out-of-band, waiting on the ODM rebase. Config-only stopgap: disable the iKVM/video capture service on nodes that do not need graphical remote console. On a GPU fleet that is usually acceptable - operators run serial-over-LAN and Redfish, not KVM - and it removes both this bug and the video-engine DMA issue below without touching firmware.

References