HPE iLO 4 / iLO 5 (remote buffer overflow): Remotely triggerable buffer overflow in the iLO firmware on both the Gen9

Impact

Remotely triggerable buffer overflow in the iLO firmware on both the Gen9 (iLO 4) and Gen10 (iLO 5) generations. Memory corruption on a service processor is the highest-value bug class in a fleet, because success means code on the BMC and therefore power control, Virtual Media, console, and an implant that persists across host reinstalls. Worth noting alongside the older iLO 4 authentication-bypass work that made this platform a known research target - the Gen9 tier tends to be the part of a fleet that stopped receiving attention.

Who can reach it

Reachable over the network to the iLO address on the out-of-band management VLAN.

What to do

Flash iLO 4 to v2.61b or later and iLO 5 to v1.39 or later. Out-of-band, per-node, no host reboot and no job drain. On Gen9 hardware the practical obstacle is inventory and change control rather than the flash itself - these are usually the nodes with the least recent firmware campaign. Interim control: hard-ACL the iLO management network.

References