Lanner IAC-AST2500A BMC firmware: An authenticated BMC user escalates to root code execution on the controller

Impact

An authenticated BMC user escalates to root code execution on the controller. It is included alongside its unauthenticated siblings because it closes a different door: an operator who mitigates the unauthenticated bugs by putting the BMC behind a bastion still has this one live for anyone holding a valid BMC credential, including monitoring accounts and any credential shared across the fleet. The outcome is the same - out-of-band power, console, virtual media and firmware-level persistence. Command injection and stack buffer overflows in the modifyUserb_func handler of spx_restservice, reachable after authentication through the user-modification path.

Who can reach it

An authenticated attacker reaching the BMC REST service. Given how commonly BMC credentials are shared across a whitebox fleet, one leaked password is fleet-wide reach.

What to do

Firmware flash from Lanner or the board integrator, with the same sourcing difficulty as the rest of this cluster. Config-only actions that help now: rotate BMC credentials to per-node unique values so a single leak is not fleet-wide, remove any BMC accounts issued to tenants or third parties, and keep the BMC REST service off any network segment reachable from tenant workloads. Note that this is one of at least nine published CVEs against this one BMC module's REST service, which is itself the signal - the codebase was not audited before shipping.

References