Lenovo ThinkSystem SR670 V2 (shipped in Manufacturing Mode): SR670 V2 servers built between roughly June 2021 and July

Impact

SR670 V2 servers built between roughly June 2021 and July 2023 left the factory still in Manufacturing Mode, which means Intel Boot Guard firmware-integrity enforcement and Intel SPS security settings can be modified or disabled. The CVSS is 2.0 and that number is misleading for a GPU operator: the SR670 V2 is a four-GPU A100/H100-class node, so the affected units are precisely the accelerator fleet, and what is broken is the hardware root of trust that is supposed to stop firmware tampering in the first place. The platform's firmware-resilience protections cannot do their job on a node in this state. This is also the rare entry where the defect ships with the hardware rather than accruing over time, so a node that has never been patched since delivery is affected by construction.

Who can reach it

An attacker with privileged logical access to the host, or physical access to the server internals - so an insider, a technician during an RMA or rack move, or a tenant with root on a bare-metal node during their tenancy. Nothing is reachable over the network.

What to do

Flash UEFI to U8E126I-2.20 or later, which closes Manufacturing Mode. As a system firmware update it applies on the next reboot, so it costs a drain and a maintenance window on a GPU node. The operational action beyond the flash: check delivery dates against the June 2021 - July 2023 window and verify Boot Guard/Manufacturing Mode state per node, because a firmware version check alone will not tell you whether a given unit shipped in this condition.

References