Database/Firmware, BMC & network fabric
Insyde InsydeH2O (unverified firmware volume in the boot chain): Certain firmware volumes are executed without being
Impact
Certain firmware volumes are executed without being verified, so the verified-boot chain has a hole in it: an attacker who can write to the unverified FV gets arbitrary code execution in firmware and the platform's own boot integrity check does not object. This is the root-of-trust failure rather than a memory-safety bug - the whole value of measured and verified boot on a GPU node is that unauthorised firmware cannot run, and here it can.
Who can reach it
An attacker able to modify the affected firmware volume - via SPI write access, a malicious capsule, or an earlier compromise with firmware-write privilege. Then any boot.
What to do
OEM BIOS update. Insyde ships fixes per Intel platform: Arrow Lake H/U 05.56.17.0022, Arrow Lake S/HX 05.56.17.0037, Raptor Lake 05.47.24.0058 (mobile) and 05.47.24.0057 (server/embedded), Alder Lake 05.47.24.2057, Meteor Lake 05.56.07.0022, Elkhart Lake 05.48.17.0030 - so check your exact silicon generation, since several platforms are listed unaffected. Advisory dated 2026-08-12, meaning OEM images are only just starting to appear; expect the Dell/HPE/Lenovo/Supermicro rebase to trail by months. Firmware flash, reboot per node. No config workaround. Meanwhile, verify SPI flash write protection is actually enforced (BIOS Lock Enable, protected range registers) so the unverified FV is not writable in the first place.
References
Related entries
- InsydeH2O UEFI firmware: embedded UEFI Shell can be used to bypass Secure BootCVE-2026-6485 · InsydeH2O UEFI firmware (embedded UEFI Shell)High
- Supermicro IPMI BMC firmware: Every affected BMC shares one TLS private key and one SSH host key, baked into theCVE-2013-3619 · Supermicro IPMI BMC firmwareHigh
- Dell iDRAC6/iDRAC7 IPMI 1.5 session handling: IPMI 1.5 session IDs are handed out incrementally from a small pool, soCVE-2014-8272 · Dell iDRAC6/iDRAC7 IPMI 1.5 session handlingHigh
- Dell iDRAC9: Stack overflow overwriting iDRAC configuration via oversized payloadsCVE-2021-21540 · Dell iDRAC9High
- GRUB2 (net/ip IPv4 reassembly): Integer underflow in grub_net_recv_ip4_packets from a crafted IP packetCVE-2022-28733 · GRUB2 (net/ip IPv4 reassembly)High
- ATEN PE8108 switched PDU: A restricted (non-admin) user account on the PDU's web interface can control outletsCVE-2023-25409 · ATEN PE8108 switched PDUHigh
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.