feregang.blogg.se

1. Bmc control d setup how to#
2. Bmc control d setup serial#
3. Bmc control d setup software#
4. Bmc control d setup code#
5. Bmc control d setup password#

Risk: High – we expect the capability and mitigation are not well known, and the mitigation has side-effects Impact: Arbitrary reads of the BMC address-space iLPC2AHB bridge Pt IIĭescription: The bit disabling the iLPC2AHB bridge only removes write access – reads are still possible. Mitigation: Can be disabled by configuring a bit in the BMC’s LPC controller, however see Pt II. Risk: High – known vulnerability and explicitly used as a feature in some platform designs Impact: Arbitrary reads and writes to the BMC address-space iLPC2AHB bridge Pt Iĭescription: A SuperIO device is exposed that provides access to the BMC’s address-space The specific issues are listed below, along with some judgement calls on their risk.

There has not been any investigation into other hardware. It only affects systems using the ASPEED ast2400, ast2500 SoCs. OpenBMC Versions affected: Up to at least 2.6, all supported Aspeed-based platforms Is likely in a separate security domain to the host. Access from userspace demonstrates the vulnerability of systems in bare-metal cloud hosting lease arrangements where the BMC The application requires root user privilege on the host system for the LPC and PCIe bridges, or normal user privilege on a remote system to exploit the debug UART interface. The intent is that it be added to platform firmware test

Bmc control d setup how to#

IBM has internally developed a proof-of-concept application that we intend to open-source, likely as part of the OpenBMC project, that demonstrates how to use the interfaces and probes for their availability. At least one BMC stack doesn’t require this, and instead offers “Press enter for console”.

Bmc control d setup password#

We obtain the current root password hash by using 1 to dump the current flash content, then using to extract the rootfs, then simply loop-mount the rootfs to access /etc/shadow. As the BMC potentially has no secure boot facility it is likely difficult to detect such actions.Ībusing 3 may require valid login credentials, but combining 1 and 2 we can simply change the locks on the BMC by replacing all instances of the root shadow password hash in RAM with a chosen password hash – one instance of the hash is in the page cache, and from that point forward any login process will authenticate with the chosen password. This may take the form of minor, malicious modifications to the officially provisioned BMC image, as we can extract, modify, then repackage the image to be re-flashed on the BMC.

Bmc control d setup code#

Using 1 we can obviously implant any malicious code we like, with the impact of BMC downtime while the flashing and reboot take place.

Bmc control d setup software#

See section 1.9 of the AST2500 Software Programming Guide.

The LPC, PCIe and UART AHB bridges are all explicitly features of Aspeed’s designs: They exist to recover the BMC during firmware development or to allow the host to drive the BMC hardware if the BMC has no firmware of its own. It is independent of host processor architecture, and has been observed on systems with x86_64 processors IBM POWER processors (there is no reason to suggest that other architectures wouldn’t be affected, these are just the ones we’ve been able to get access to) This affects multiple BMC firmware stacks, including OpenBMC, AMI’s BMC, and SuperMicro. This stems from AHB bridges on the LPC and PCIe buses, another on the BMC console UART (hardware password protected), and the ability of the X-DMA engine to address all of the BMC’s M-Bus (memory bus).

Bmc control d setup serial#

The ASPEED ast2400 and ast2500 Baseboard Management Controller (BMC) hardware and firmware implement Advanced High-performance Bus (AHB) bridges, which allow arbitrary read and write access to the BMC’s physical address space from the host, or from the network if the BMC console uart is attached to a serial concentrator (this is atypical for most systems).Ĭommon configuration of the ASPEED BMC SoC’s hardware features leaves it open to “remote” unauthenticated compromise from the host and from the BMC console. I expect OpenBMC to have a statement shortly. This is details for CVE-2019-6260 – which has been nicknamed “pantsdown” due to the nature of feeling that we feel that we’ve “caught chunks of the industry with their…” and combined with the fact that naming things is hard, so if you pick a bad name somebody would have to come up with a better one before we publish.