HPE iLO 5 (local privilege escalation to code execution): An unprivileged user can execute arbitrary code in the iLO

Impact

An unprivileged user can execute arbitrary code in the iLO context. This is one of a batch of a dozen-plus iLO 5 defects HPE fixed in the same firmware release, which is itself the useful signal: the iLO 5 codebase had a cluster of memory-safety and access-control problems reachable without high privilege. Any one of them lands the attacker on the service processor, with the usual consequences - power, Virtual Media boot, console, and persistence below the hypervisor.

Who can reach it

An unprivileged actor with local access to the iLO's own execution environment - in practice, someone who already has a low-privilege iLO account or a foothold reached through one of the sibling defects in the same batch. Not an unauthenticated internet-facing entry point.

What to do

Flash iLO 5 to v2.71 or later - and note that the later CVE-2022-28639 batch requires v2.72, so go straight to the highest available iLO 5 build rather than patching to the floor. Out-of-band, per-node, no host reboot and no drain. Treat this as one flash covering a whole batch of CVEs, which makes the per-node rollout cost-effective.

References