SB2025040505 - Multiple vulnerabilities in Intel Server Board BMC firmware

Description

This security bulletin contains information about 5 secuirty vulnerabilities.

1) Information disclosure (CVE-ID: CVE-2023-25191)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by Redfish in AMI MegaRAC SPX devices. A remote attacker can obtain an administrative password and compromise the affected system.

2) Information disclosure (CVE-ID: CVE-2023-25192)

The vulnerability allows a remote attacker to enumerate user accounts

The vulnerability exists due to excessive data output by Redfish. A remote attacker can enumerate user accounts.

3) Uncaught Exception (CVE-ID: CVE-2025-20097)

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to an uncaught exception in OpenBMC Firmware. A remote user can pass specially crafted input to the system and perform a denial of service (DoS) attack.

4) Heap-based buffer overflow (CVE-ID: CVE-2023-31276)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error. A local privileged user can trigger a heap-based buffer overflow and execute arbitrary code with elevated privileges.

5) Improper access control (CVE-ID: CVE-2023-29164)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper access restrictions in in BMC Firmware. A local user can escalate privileges on the system.

Remediation

Install update from vendor's website.

References

• https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023002.pdf
• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00990.html
• https://intel.com/content/www/us/en/security-center/advisory/intel-sa-00990.html