Dell PowerEdge Server BIOS (AMD platforms, TOCTOU race): A time-of-check/time-of-use race in BIOS gives

Impact

A time-of-check/time-of-use race in BIOS gives a low-privileged local attacker access to resources outside its authorization. Relevant to the AMD EPYC-based GPU platforms.

Who can reach it

Local low-privilege user on an AMD-based PowerEdge.

What to do

Flash the fixed PowerEdge BIOS. A BIOS update is a cold reboot per node and cannot be done live - on a GPU fleet that means draining jobs and taking the box out of the scheduler, so batch it with other firmware work rather than doing a standalone pass.

References