Supermicro OpenBMC firmware image verification (MBD-X12DPG-OA6), fat->fsd.max_fld field: The BMC's own firmware-image

Impact

The BMC's own firmware-image parser overflows its stack on an unchecked length field in the image header - meaning the code that is supposed to decide whether an update is trustworthy can be taken over by the untrusted update itself. This is the bug class that defeats a hardware root of trust: it does not matter that the SoC verifies signatures if you get control inside the verifier before verification completes. The prize is a permanent BMC implant that survives host reimage, node redeployment and tenant handover, on a platform explicitly marketed as an OpenBMC server board.

Who can reach it

Requires BMC administrator privileges to submit a firmware image - so it is a second-stage bug. But 'admin on the BMC' is exactly what the credential-disclosure, default-password and authentication-bypass entries elsewhere in this cluster hand an attacker, and it is also what a malicious insider or a compromised firmware-management pipeline already has.

What to do

Fixed in Supermicro's January 2025 BMC/IPMI firmware drop - a per-node out-of-band BMC flash, with the ordinary brick risk if interrupted. Beyond patching, this argues for treating BMC firmware update authority as a privileged operation in its own right: restrict which systems hold BMC admin credentials, require change control on firmware pushes, and verify BMC flash contents out-of-band after updates rather than trusting the BMC's own report of what it is running.

References