AMI MegaRAC SPx 12 / SPx 13 (BMC TLS certificate generation): Malformed input to the BMC's certificate-generation

Impact

Malformed input to the BMC's certificate-generation function permanently wedges the controller, and the only documented recovery is a factory reset. On a GPU fleet that is worse than a normal DoS: you lose out-of-band power control, console and virtual media on the affected nodes, and getting them back means an on-site factory reset that also wipes your BMC configuration - accounts, certificates, network settings, alert destinations - so every affected node has to be re-provisioned by hand. A malicious insider or a compromised management account can do this across a rack in minutes and cost you days of remote-hands work.

Who can reach it

Network access to the BMC with high privileges - an administrative BMC account. Because BMC admin credentials are so often cloned across a fleet by the provisioning system, one leaked credential scales this to every node that shares it.

What to do

Firmware flash to SPx_12-update-5.00 / SPx_13-update-3.00 or later, out-of-band per node, ODM-gated. Config-only risk reduction: unique per-node BMC admin credentials so one leak cannot sweep the fleet, and - critically - keep an exported, version-controlled copy of every BMC's configuration so that if you do have to factory-reset, restoring is automated rather than a per-node manual rebuild.

References