Kure kure kusagadzikana muIntel server mabhodhi ane BMC Emulex Pilot 3

Intel yakashuma pakubvisa 22 kusasimba muiyo firmware yeayo server mamaboards, server system uye computing modules. Hutatu husina simba, imwe yacho inopihwa nhanho yakakosha, (CVE-2020-8708 - CVSS 9.6, CVE-2020-8707 - CVSS 8.3, CVE-2020-8706 - CVSS 4.7) anooneka mune firmware yeEmulex Pilot 3 BMC controller inoshandiswa muIntel zvigadzirwa. Iko kusasimba kunobvumira kupinda kusingabvumirwe kupinda kune kure manejimendi koni (KVM), yekupfuura chokwadi kana uchitevedzera USB midziyo yekuchengetera, uye kukonzera kure kure buffer kufashukira muLinux kernel inoshandiswa muBMC.

Kusagadzikana kweCVE-2020-8708 kunobvumira munhu asina kutenderwa anorwisa kuti awane mukana kune yakajairwa yenzvimbo network segment ine iri panjodzi server kuti iwane mukana weiyo BMC yekudzora nharaunda. Zvinocherechedzwa kuti hunyanzvi hwekushandisa hutachiona huri nyore uye hwakavimbika, nekuti dambudziko rinokonzerwa nekukanganisa kwekuvaka. Uyezve, maererano maererano Mushure mekunge muongorori aona kusazvibata, kushanda neBMC kuburikidza nekushandisa kuri nyore pane kushandisa yakajairwa Java mutengi. Pakati pemidziyo yakabatwa nedambudziko imhuri dzeIntel server system R1000WT, R2000WT, R1000SP, LSVRP, LR1304SP, R1000WF uye R2000WF, mamaboards S2600WT, S2600CW, S2600KP, S2600KP, S1200KP, S2600S2600SP2600SSP2600, S2600S2600SP1.59SPXNUMXSSPXNUMXTP, SXNUMXSXNUMXTP, SXNUMXSXNUMXSPXNUMXSSPXNUMXTP, SXNUMXSXNUMXSPXNUMXSSPXNUMXSSPXNUMXTP, SXNUMXSPXNUMXSSPXNUMXSPXNUMXSPXNUMXSPXNUMXSPXNUMXSPXNUMXSP, SXNUMXSPXNUMXSPXNUMXSP. XNUMXBP, pamwe nekombuta modules HNSXNUMXKP, HNSXNUMXTP uye HNSXNUMXBP . Kusagadzikana kwakagadziriswa mune firmware update XNUMX.

Maererano na unofficial kupihwa Iyo firmware yeBMC Emulex Pilot 3 yakanyorwa neAMI, saka isina kubviswa kuratidzwa kwekusagadzikana pane masisitimu kubva kune vamwe vanogadzira. Matambudziko aripo mune ekunze zvigamba kuLinux kernel uye mushandisi-nzvimbo yekudzora maitiro, iyo kodhi iyo inoratidzirwa nemuongorori akaona dambudziko sekodhi yakaipisisa yaakambosangana nayo.

Ngatiyeukei kuti BMC inyanzvi inodzora yakaiswa mumaseva, ine yayo CPU, ndangariro, chengetedzo uye sensor polling interfaces, iyo inopa yakaderera-level interface yekutarisa uye kutonga server midziyo. Uchishandisa BMC, zvisinei neiyo inoshanda sisitimu inoshanda pane sevha, unogona kutarisa mamiriro emasensa, maneja simba, firmware uye disks, kuronga kure kure booting pamusoro petiweki, simbisa kushanda kweiyo kure yekuwana console, nezvimwe.

Source: opennet.ru