Database/Firmware, BMC & network fabric
Firmware signing-key compromise as a class: Firmware trust anchors (Boot Guard KM/BPM, UEFI PK/KEK, BMC image-signing
NCVD-0000-008-firmware-signing-key-compromiseFirmware, BMC & network fabriccurated
Impact
Firmware trust anchors (Boot Guard KM/BPM, UEFI PK/KEK, BMC image-signing keys) are held by ODMs with weaker security postures than the clouds that deploy their hardware, and several have been breached. A neocloud inherits the ODM's key hygiene
Who can reach it
Supply chain
What to do
Requires diligence on ODM key custody at purchase time and an independent measured-boot / firmware-integrity baseline so a signed-but-malicious image is still detectable. Cannot be remediated after the fact
References
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.