Security Flaws in AMI BMC Can Expose Many Data Centers, Clouds to Attacks

Researchers at firmware and hardware security company Eclypsium have identified several potentially serious vulnerabilities in baseboard management controller (BMC) firmware made by AMI (American Megatrends) and used by some of the world’s biggest server manufacturers.

Eclypsium started analyzing the firmware in August, after it came across a data leak allegedly originating from AMI. The firm decided to analyze the leaked software to see if it could find any vulnerabilities, to ensure that they get patched in case malicious actors would also be looking for security flaws to exploit.

The analysis focused on AMI’s MegaRAC BMC, which is used by companies such as AMD, Ampere, Asrock, Asus, Arm, Dell, Gigabyte, HPE, Huawei, Inspur, Lenovo, Nvidia, Qualcomm, Quanta, and Tyan.

“This firmware is a foundational component of modern computing found in hundreds of thousands of servers in data centers, server farms, and cloud infrastructure around the world. And since devices in these environments typically standardize on a hardware configuration, a vulnerable configuration could likely be shared across thousands of devices,” Eclypsium said.

“MegaRAC BMC firmware is one of the common threads that connects much of the hardware that underlies the cloud. As a result, any vulnerability in MegaRAC can easily spread through the extended supply chain to affect dozens of vendors and potentially millions of servers,” the company added.

BMC allows administrators to remotely control and monitor a device without having to access the operating system or applications running on it. The BMC can be used to install an operating system, update the firmware, monitor system parameters, and analyze logs — capabilities that can make it a tempting target for threat actors.

Eclypsium’s research of the AMI BMC led to the discovery of three vulnerabilities, which the company collectively tracks as BMC&C. The vulnerabilities can pose a significant risk not only to individual devices, but also to data centers and cloud services.

The most serious of the BMC&C flaws, tracked as CVE-2022-40259 and rated ‘critical’, can be exploited for arbitrary code execution. A low-privileged account is needed for exploitation.

Another flaw, identified as CVE-2022-40242 and rated ‘high severity’, is related to default credentials that allow access with elevated privileges. Access to the targeted device is required for exploiting this vulnerability.

The third issue is also ‘high severity’ and it allows an attacker to conduct user enumeration, which can be useful for brute force or credential stuffing attacks.

“These vulnerabilities could be exploited by an attacker that has gained initial access into a data center or administrative network. As data centers tend to standardize on specific hardware platforms, any BMC-level vulnerability would most likely apply to large numbers of devices and could potentially affect an entire data center and the services that it delivers,” Eclypsium warned in its disclosure.

In a real world attack scenario, a malicious actor could exploit the vulnerabilities to remotely control compromised servers, deploy malware or firmware implants, and cause physical damage to the targeted device.

AMI and other impacted vendors have been notified before Eclypsium disclosed its findings, but even if patches are created, it could take a long time until they’re widely deployed.

Eclypsium’s Scott Scheferman described the coordinated disclosure process as one of the most intense in his career.

“Bottom line: this will likely impact you if you are a cloud-forward organization relying on the implicit trust dynamics of relegating security visibility and vulnerability management of the cloud platform to the cloud provider,” Scheferman said, adding, “These vulns extend to on-site servers and customer-owned data centers as well.”

Eclypsium said it does not know if the vulnerabilities have been exploited for malicious purposes, but it cannot be ruled out considering that the issues were discovered in leaked software that is likely in the possession of multiple threat groups. The cybersecurity firm pointed out that the recently discovered iLOBleed rootkit targets the BMC firmware, which means these types of attacks are not just theoretical.

Related: BMC Firmware Vulnerabilities Expose OT, IoT Devices to Remote Attacks

Related: QCT Servers Affected by ‘Pantsdown’ BMC Vulnerability

Related: NVIDIA Patches AMI BMC Vulnerabilities Impacting Several Major Vendors