Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cloud Security

Security Flaws in AMI BMC Can Expose Many Data Centers, Clouds to Attacks

Researchers at firmware and hardware security company Eclypsium have identified several potentially serious vulnerabilities in baseboard management controller (BMC) firmware made by AMI (American Megatrends) and used by some of the world’s biggest server manufacturers.

Researchers at firmware and hardware security company Eclypsium have identified several potentially serious vulnerabilities in baseboard management controller (BMC) firmware made by AMI (American Megatrends) and used by some of the world’s biggest server manufacturers.

Eclypsium started analyzing the firmware in August, after it came across a data leak allegedly originating from AMI. The firm decided to analyze the leaked software to see if it could find any vulnerabilities, to ensure that they get patched in case malicious actors would also be looking for security flaws to exploit.

The analysis focused on AMI’s MegaRAC BMC, which is used by companies such as AMD, Ampere, Asrock, Asus, Arm, Dell, Gigabyte, HPE, Huawei, Inspur, Lenovo, Nvidia, Qualcomm, Quanta, and Tyan.

“This firmware is a foundational component of modern computing found in hundreds of thousands of servers in data centers, server farms, and cloud infrastructure around the world. And since devices in these environments typically standardize on a hardware configuration, a vulnerable configuration could likely be shared across thousands of devices,” Eclypsium said.

“MegaRAC BMC firmware is one of the common threads that connects much of the hardware that underlies the cloud. As a result, any vulnerability in MegaRAC can easily spread through the extended supply chain to affect dozens of vendors and potentially millions of servers,” the company added.

BMC allows administrators to remotely control and monitor a device without having to access the operating system or applications running on it. The BMC can be used to install an operating system, update the firmware, monitor system parameters, and analyze logs — capabilities that can make it a tempting target for threat actors.

Eclypsium’s research of the AMI BMC led to the discovery of three vulnerabilities, which the company collectively tracks as BMC&C. The vulnerabilities can pose a significant risk not only to individual devices, but also to data centers and cloud services.

The most serious of the BMC&C flaws, tracked as CVE-2022-40259 and rated ‘critical’, can be exploited for arbitrary code execution. A low-privileged account is needed for exploitation.

Advertisement. Scroll to continue reading.

Another flaw, identified as CVE-2022-40242 and rated ‘high severity’, is related to default credentials that allow access with elevated privileges. Access to the targeted device is required for exploiting this vulnerability.

The third issue is also ‘high severity’ and it allows an attacker to conduct user enumeration, which can be useful for brute force or credential stuffing attacks.

“These vulnerabilities could be exploited by an attacker that has gained initial access into a data center or administrative network. As data centers tend to standardize on specific hardware platforms, any BMC-level vulnerability would most likely apply to large numbers of devices and could potentially affect an entire data center and the services that it delivers,” Eclypsium warned in its disclosure.

In a real world attack scenario, a malicious actor could exploit the vulnerabilities to remotely control compromised servers, deploy malware or firmware implants, and cause physical damage to the targeted device.

AMI and other impacted vendors have been notified before Eclypsium disclosed its findings, but even if patches are created, it could take a long time until they’re widely deployed.

Eclypsium’s Scott Scheferman described the coordinated disclosure process as one of the most intense in his career.

“Bottom line: this will likely impact you if you are a cloud-forward organization relying on the implicit trust dynamics of relegating security visibility and vulnerability management of the cloud platform to the cloud provider,” Scheferman said, adding, “These vulns extend to on-site servers and customer-owned data centers as well.”

Eclypsium said it does not know if the vulnerabilities have been exploited for malicious purposes, but it cannot be ruled out considering that the issues were discovered in leaked software that is likely in the possession of multiple threat groups. The cybersecurity firm pointed out that the recently discovered iLOBleed rootkit targets the BMC firmware, which means these types of attacks are not just theoretical.

Related: BMC Firmware Vulnerabilities Expose OT, IoT Devices to Remote Attacks

Related: QCT Servers Affected by ‘Pantsdown’ BMC Vulnerability

Related: NVIDIA Patches AMI BMC Vulnerabilities Impacting Several Major Vendors

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Vulnerabilities

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...

Vulnerabilities

A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

CISO Conversations

SecurityWeek talks to Billy Spears, CISO at Teradata (a multi-cloud analytics provider), and Lea Kissner, CISO at cloud security firm Lacework.

Cybercrime

Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.