ASPEED USB device controller driver (drivers/usb/gadget/udc/aspeed_udc.c): The BMC presents itself to the host over USB

Impact

The BMC presents itself to the host over USB - that is how OpenBMC does virtual media, USB-network (the host-to-BMC management channel) and HID for iKVM. The endpoint index coming from the host is used without a bounds check, so the host walks past the endpoint array into adjacent BMC kernel memory. The direction of travel is what matters here: the host is the untrusted side on a rented bare-metal node, and this is a host-controlled index into BMC kernel structures. It is a genuine tenant-to-BMC crossing, not a BMC-local bug.

Who can reach it

Requires the ability to drive USB control traffic from the host to the BMC's USB gadget - root on the bare-metal server, which any tenant of that node has. The gadget is enabled by default on OpenBMC platforms that offer virtual media or a USB management NIC.

What to do

Kernel patch backported across stable trees; on real fleets it arrives only in a new BMC firmware image, so per-node out-of-band flash with the usual ODM lag and brick risk. Partial config mitigation: unbind or do not compose the virtual-media and USB-gadget functions on nodes that do not need them. That is often viable for GPU nodes provisioned by network boot, less so where the ODM's own management path rides the USB NIC.

References

Related entries

• Dell SmartFabric OS10 (execution with unnecessary privileges): Low-privileged local attacker reaches command executionCVE-2024-48837 · Dell SmartFabric OS10 (execution with unnecessary privileges)High
• Dell SmartFabric OS10 (command injection): Command injection from a low-privileged local account leading to codeCVE-2024-49557 · Dell SmartFabric OS10 (command injection)High
• Dell SmartFabric OS10 (improper privilege management): A low-privileged local attacker elevates privileges on the switchCVE-2024-49558 · Dell SmartFabric OS10 (improper privilege management)High
• Dell SmartFabric OS10 (command injection): A low-privileged local attacker executes commands on the switch OSCVE-2024-49560 · Dell SmartFabric OS10 (command injection)High
• Dell SmartFabric OS10 (incorrect privilege assignment): Local low-privilege attacker escalates privileges on the switchCVE-2024-49561 · Dell SmartFabric OS10 (incorrect privilege assignment)High
• Linux kernel (drivers/net/ethernet/mellanox/mlx5/core): When a DMA mapping fails on the multi-packet transmit path, theCVE-2024-50001 · Linux kernel (drivers/net/ethernet/mellanox/mlx5/core)High