ASPEED USB device controller driver (drivers/usb/gadget/udc/aspeed_udc.c): The BMC presents itself to the host over USB

Impact

The BMC presents itself to the host over USB - that is how OpenBMC does virtual media, USB-network (the host-to-BMC management channel) and HID for iKVM. The endpoint index coming from the host is used without a bounds check, so the host walks past the endpoint array into adjacent BMC kernel memory. The direction of travel is what matters here: the host is the untrusted side on a rented bare-metal node, and this is a host-controlled index into BMC kernel structures. It is a genuine tenant-to-BMC crossing, not a BMC-local bug.

Who can reach it

Requires the ability to drive USB control traffic from the host to the BMC's USB gadget - root on the bare-metal server, which any tenant of that node has. The gadget is enabled by default on OpenBMC platforms that offer virtual media or a USB management NIC.

What to do

Kernel patch backported across stable trees; on real fleets it arrives only in a new BMC firmware image, so per-node out-of-band flash with the usual ODM lag and brick risk. Partial config mitigation: unbind or do not compose the virtual-media and USB-gadget functions on nodes that do not need them. That is often viable for GPU nodes provisioned by network boot, less so where the ODM's own management path rides the USB NIC.

References