Intel Server OpenBMC firmware (before egs-1.15-0 / bhs-0.27): An out-of-bounds read reachable by a privileged BMC user

Impact

An out-of-bounds read reachable by a privileged BMC user leaks memory contents across a scope boundary - CVSS v4 scores it 8.1, notably higher than the v3 6.7, because the disclosure crosses out of the vulnerable component. What comes back is BMC process memory, which on this stack means session tokens, credential material and configuration. Combined with the privilege-escalation entry from the same product line, an attacker with a modest BMC account has a path to reading things that let them keep the access permanently.

Who can reach it

Local access on the BMC with a privileged account. Requires an existing high-privilege BMC credential, so this is a post-compromise deepening tool rather than an entry point.

What to do

Fixed in Intel Server OpenBMC egs-1.15-0 / bhs-0.27 and later - per-node out-of-band BMC firmware update via Intel platform packages, subject to OEM rebase lag on boards that derive from the same base. No config-only mitigation for the bug itself; limit the blast radius by minimizing the number of accounts holding BMC admin and by rotating BMC credentials after any suspected node compromise.

References