IBM OpenBMC: authenticated BMC admin gets code execution via the firmware update process

Impact

An administrator-level account on the BMC can, under conditions IBM does not detail, get arbitrary code execution on the service processor itself rather than only the privileged management operations the role is supposed to grant. Code on a BMC sits below the host OS: it survives host reinstalls, sees the host power/console/storage paths, and is not visible to anything running on the node. In a GPU fleet the BMC network is usually flat across racks and shares one credential set, so a single compromised BMC admin credential turns into persistent presence on any node reachable from the management VLAN. Recovering a node means flashing the BMC out of band, which takes it out of service.

Who can reach it

Adjacent-network reach to the BMC (management VLAN or BMC subnet) plus valid administrator-level BMC credentials. Authentication is required; this is not an unauthenticated remote flaw.

What to do

Apply the BMC firmware level named in IBM's advisory (node 7283590) for FW1060.00 through FW1060.80 - the record does not state the fixed level, so take it from the advisory rather than assuming. Updating a BMC is a firmware flash on the service processor and typically requires the node to be quiesced; plan it as an out-of-service window per node. In the meantime, restrict BMC management access to a dedicated VLAN or jump host and audit who holds BMC administrator credentials.

References