Chiwopsezo mu BMC controller firmware yokhudza ma seva kuchokera kwa opanga ambiri

Kampani ya Eclypsium kuwululidwa ziwopsezo ziwiri mu firmware ya wolamulira wa BMC woperekedwa mu ma seva a Lenovo ThinkServer, kulola wogwiritsa ntchito wamba kuti asinthe firmware kapena kupereka kachidindo kosagwirizana ndi BMC chip side.

Kusanthula kwina kunawonetsa kuti mavutowa amakhudzanso firmware ya olamulira a BMC omwe amagwiritsidwa ntchito pa nsanja za seva za Gigabyte Enterprise Servers, zomwe zimagwiritsidwanso ntchito m'maseva ochokera kumakampani monga Acer, AMAX, Bigtera, Ciara, Penguin Computing ndi sysGen. Olamulira ovuta a BMC adagwiritsa ntchito firmware ya MergePoint EMS yomwe ili pachiwopsezo yopangidwa ndi ogulitsa chipani chachitatu Avocent (tsopano ndi gawo la Vertiv).

Chiwopsezo choyamba chimayamba chifukwa chosowa kutsimikizira kwachinsinsi kwa zosintha za firmware zomwe zidatsitsidwa (kutsimikizira kwa CRC32 checksum kokha kumagwiritsidwa ntchito, mosiyana. ndondomeko NIST imagwiritsa ntchito siginecha ya digito), zomwe zimalola wowukira yemwe ali ndi mwayi wofikira kudongosolo kuti awononge firmware ya BMC. Vutoli, mwachitsanzo, lingagwiritsidwe ntchito kuphatikizira kwambiri rootkit yomwe imakhalabe yogwira pambuyo pokhazikitsanso makina ogwiritsira ntchito ndikuletsa zosintha zina za firmware (kuchotsa rootkit, muyenera kugwiritsa ntchito pulogalamu kuti mulembenso kung'anima kwa SPI).

Chiwopsezo chachiwiri chilipo mu code yosinthira firmware ndikukulolani kuti mulowe m'malo mwa malamulo anu, omwe adzaperekedwa mu BMC ndi mwayi wapamwamba kwambiri. Kuti muwukire, ndikwanira kusintha mtengo wa RemoteFirmwareImageFilePath parameter mu fayilo ya kasinthidwe ya bmcfwu.cfg, momwe njira yopita ku chithunzi cha firmware yosinthidwa imatsimikiziridwa. Pakusintha kotsatira, komwe kungayambitsidwe ndi lamulo mu IPMI, gawoli lidzasinthidwa ndi BMC ndikugwiritsidwa ntchito ngati gawo la popen() kuyitana ngati gawo la mzere wa /bin/sh. Popeza mzere wopanga chipolopolo umapangidwa pogwiritsa ntchito foni ya snprintf () popanda kuyeretsa bwino zilembo zapadera, owukira amatha kulowetsamo code yawo kuti aphedwe. Kuti mugwiritse ntchito chiwopsezo, muyenera kukhala ndi ufulu womwe umakulolani kutumiza lamulo kwa wolamulira wa BMC kudzera pa IPMI (ngati muli ndi ufulu woyang'anira pa seva, mutha kutumiza IPMI lamulo popanda kutsimikizika kowonjezera).

Gigabyte ndi Lenovo adadziwitsidwa za zovutazo mu Julayi 2018 ndipo adakwanitsa kutulutsa zosintha zisanawululidwe poyera. Kampani ya Lenovo anamasulidwa zosintha za firmware pa Novembara 15, 2018 za ma seva a ThinkServer RD340, TD340, RD440, RD540 ndi RD640, koma adangochotsa chiwopsezo mwa iwo chomwe chimaloleza kuloweza m'malo, kuyambira pakupangidwa kwa ma seva ozikidwa pa MergePoint EMS mu 2014, firmware. kutsimikizira kunachitika pogwiritsa ntchito siginecha ya digito sikunali kufalikira ndipo sikunalengezedwe poyambirira.

Pa Meyi 8 chaka chino, Gigabyte adatulutsa zosintha za firmware zamabodi a amayi okhala ndi ASPEED AST2500 controller, koma monga Lenovo, idangokhazikitsa chiwopsezo cholowa m'malo mwa lamulo. Ma board omwe ali pachiwopsezo otengera ASPEED AST2400 amakhalabe opanda zosintha pakadali pano. Gigabyte komanso adalengeza za kusintha kwa MegaRAC SP-X firmware kuchokera ku AMI. Kuphatikizapo firmware yatsopano yozikidwa pa MegaRAC SP-X idzaperekedwa pamakina omwe adatumizidwa kale ndi firmware ya MergePoint EMS. Chigamulochi chikutsatira chilengezo cha Vertiv kuti sichidzathandizanso nsanja ya MergePoint EMS. Panthawi imodzimodziyo, palibe chomwe chanenedwa ponena za zosintha za firmware pa ma seva opangidwa ndi Acer, AMAX, Bigtera, Ciara, Penguin Computing ndi sysGen kutengera matabwa a Gigabyte ndipo ali ndi firmware ya MergePoint EMS.

Tiyeni tikumbukire kuti BMC ndi woyang'anira wapadera woikidwa m'maseva, omwe ali ndi CPU yake, kukumbukira, kusungirako ndi mavoti opangira ma sensor, omwe amapereka mawonekedwe otsika kwambiri poyang'anira ndi kuyang'anira zida za seva. Pogwiritsa ntchito BMC, mosasamala kanthu za makina ogwiritsira ntchito pa seva, mukhoza kuyang'anira momwe masensa amachitira, kuyang'anira mphamvu, firmware ndi ma disks, kukonzekera kuthamangitsidwa kwakutali pa intaneti, kuonetsetsa kuti makina olowera kutali akugwira ntchito, ndi zina zotero.

Source: opennet.ru