HPE ProLiant RL300 Gen11 (UEFI firmware, out-of-bounds read): Out-of-bounds reads in the UEFI firmware of the ProLiant

Impact

Out-of-bounds reads in the UEFI firmware of the ProLiant RL300 Gen11 - HPE's Arm-based (Ampere) ProLiant. The CVSS vector marks scope as changed with high confidentiality impact, meaning the leak crosses a trust boundary out of the firmware context. Firmware-level memory disclosure is how an attacker recovers the addresses and secrets that make a subsequent firmware write reliable, so treat it as an enabler for a persistence attack rather than as a standalone data-loss event. Relevant to operators running mixed-architecture racks where Arm nodes handle inference or control-plane duty alongside x86 GPU boxes.

Who can reach it

Local to the host with high privileges - a root/administrator account on the operating system. Not remotely reachable and not exposed on the management VLAN.

What to do

UEFI firmware update on the affected RL300 Gen11 nodes. As with any system firmware, it applies on the next reboot, so it costs a maintenance window per node rather than a live out-of-band flash. Small affected footprint means the campaign should be quick to scope - identify RL300 Gen11 nodes specifically, since the rest of the ProLiant Gen11 line is not in scope. No config-only mitigation.

References