Supermicro BIOS SMM callout (X11DPH-T / X11DPH-Tq): Execution in System Management Mode, the most privileged execution

Impact

Execution in System Management Mode, the most privileged execution context on the machine - above the hypervisor, invisible to the OS, and able to write the platform's own firmware. An SMM implant is the deepest persistent foothold available on an x86 node: it survives OS reinstall, disk replacement, and hypervisor redeployment, and no host-based tooling can enumerate it. For a bare-metal operator this is the finding that breaks the tenant handoff guarantee outright, because you cannot prove a returned node is clean. And X11DPH-i before version 4.4 - SMM code calling out to memory the attacker controls, which is the classic route from ring 0 into ring -2.

Who can reach it

Local, host-side, high privilege - root on the node's OS, triggering the SMI that reaches the vulnerable callout. Attack complexity is rated high, so it is a targeted attack rather than an opportunistic one, but a bare-metal tenant has unlimited time and full access to attempt it.

What to do

BIOS flash to 4.4 or later from Supermicro's July 2024 BIOS advisory, per board. Same image covers the arbitrary-write issues on the neighbouring X11DPH SKUs, so batch them. There is no configuration change that mitigates an SMM callout. If you rent bare metal on these boards, the additional operational control worth adding is a firmware measurement taken at node return and compared against a known-good baseline, since a patched BIOS does not tell you whether the node was implanted before you patched it.

References