HPE iLO 5 (firmware update security restriction bypass): Bypass of the security restrictions that guard iLO 5 firmware

Impact

Bypass of the security restrictions that guard iLO 5 firmware updates. The severity number undersells what this is: the firmware-update gate is the control that stops an attacker from writing their own image to the service processor. Defeat it and the attacker installs persistent BMC firmware of their choosing - the deepest and most durable implant available on the node, below the hypervisor and untouched by any host reimage. On a bare-metal cloud, a node whose iLO firmware was replaced by a previous tenant never comes clean again through normal reprovisioning.

Who can reach it

Local exploitation - an attacker who already has a foothold on the node or its iLO context, not an unauthenticated remote attacker. The realistic path in a bare-metal fleet is a tenant with host-level access using it during their tenancy to leave something behind for the next one.

What to do

Flash iLO 5 to v1.37 or later - out-of-band, per-node, no host reboot and no job drain. Complementary control that matters more than the version number: enable and actually check the iLO firmware integrity/attestation features HPE exposes, and verify iLO firmware version and measurement as part of node reprovisioning between tenants rather than trusting that a wipe covered it.

References