Supermicro BMC firmware image verification routine on MBD-X12DPG-OA6: A crafted update image smashes the stack

Impact

A crafted update image smashes the stack of the code that was supposed to be checking that image, giving the attacker execution inside the BMC's update path. The result is an operator-invisible firmware implant on a GPU node: control of power sequencing, virtual media, and the console, plus the ability to falsify what the BMC reports about itself. On a board specifically sold for GPU workloads, this is the persistence mechanism an attacker wants after gaining any temporary administrative access. A dual-socket GPU-oriented board. The parser fails to bound-check a length field in the image container before copying, so the verification code itself is the memory-safety bug.

Who can reach it

An authenticated high-privilege BMC session that can submit a firmware image. Reachability is whatever your management network allows - typically the OOB VLAN plus whatever provisioning automation holds BMC admin credentials.

What to do

Firmware flash with the fixed BMC image from Supermicro's January 2025 BMC/IPMI advisory. There is no config-only fix, because the vulnerable code is the update handler. Practical hardening in the meantime: deny BMC firmware upload from anything except a single hardened provisioning host, and treat any node whose BMC accepted an unexpected image as needing an out-of-band SPI reflash rather than a software update.

References