Vulnerability Disclosure:
The purpose of this disclosure is to communicate the potential vulnerabilities affecting Supermicro products that were reported by an external researcher.
Acknowledgment
Supermicro would like to acknowledge the work done by Alexander Tereshkin, NVIDIA Offensive Security Research Team for discovering potential vulnerability in Supermicro BMC IPMI Firmware.
Summary:
Several security issues have been discovered in select Supermicro motherboards. These issues affect Supermicro BMC Firmware.
| CVE ID | Internal ID | Severity | Description |
|---|---|---|---|
| CVE-2024-10237 | SMC-2024100039 | High | There is a vulnerability in the BMC firmware image authentication design. An attacker can modify the firmware to bypass BMC inspection and bypass the signature verification process. |
| CVE-2024-10238 | SMC-2024100040 | High | A security issue in the firmware image verification implementation. An attacker can upload a specially crafted image that will cause a stack overflow that is caused by not checking fld->used_bytes |
| CVE-2024-10239 | SMC-2024100041 | High | A security issue in the firmware image verification implementation. An attacker can upload a specially crafted image that will cause a stack overflow that is caused by not checking fat->fsd.max_fld. |
Affected products:
Supermicro BMC firmware in select X11, X12, H12, B12, X13, H13, B13, X14, H14, B14, G1, and G2 motherboards (and CMM6 modules).
Click to expand and see the complete list of affected products
| Motherboard | BMC Firmware version with the fix |
|---|---|
| X11DGQ | 3.77.13 |
| X11DPD-L | 3.77.13 |
| X11DPD-M25 | 3.77.13 |
| X11DPFF-SN | 3.77.13 |
| X11DPL-I-B | 3.77.13 |
| X11DPL-I | 3.77.13 |
| X11DPL-I | 3.77.13 |
| X11DPS-R | 3.77.13 |
| X11DPS-RE | 3.77.13 |
| X11DPT-L | 3.77.13 |
| X11DSC+ | 3.77.13 |
| X11DSF-E | 3.77.13 |
| X11DSF | 3.77.13 |
| X11SCW-F-AM047 | 3.77.13 |
| X11SCW-F-B | 3.77.13 |
| X11SCW-F | 3.77.13 |
| X11SCW-F | 3.77.13 |
| X11SRI-IF | 3.77.13 |
| B12DPT | 01.05.28 |
| B12SPE-CPU-TF | 01.05.28 |
| BH12SSI-M25 | 01.05.28 |
| B12DPT-6 | 01.05.29 |
| H12SSFF-AN6 | 01.05.29 |
| X12DPGA6-GD2 | 01.05.29 |
| X12DPGA6 | 01.05.29 |
| X12DPT-B | 01.05.29 |
| X12DPT-B6 | 01.05.29 |
| X12DPTT46 | 01.05.29 |
| X12SPTT | 01.05.29 |
| X12DPT-B6S | 01.05.29 |
| X12DPTT6 | 01.05.29 |
| X12DPTS6 | 01.05.29 |
| X12DPTT6S | 01.05.29 |
| X12DPD-A6M25 | 01.05.29 |
| B12DPE-6 | 01.05.29 |
| B12SPE-CPU-25G | 01.05.29 |
| X12DGQ-R | 01.05.29 |
| X12DPG-QR | 01.05.29 |
| H12DSG-CPU6-TI036 | 01.05.29 |
| X12STW-F | 01.05.29 |
| X12STW-TF | 01.05.29 |
| B3ST1-CPU-001 | 01.05.28 |
| X13DEM | 01.03.38 |
| X13DET-B | 01.03.38 |
| X13DSF-A | 01.03.38 |
| X13SEDW-F | 01.03.38 |
| X13SEED-F | 01.03.38 |
| X13SEED-SF | 01.03.38 |
| X13SEFR-A | 01.03.38 |
| X13SEM-F | 01.03.38 |
| X13SEM-TF | 01.03.38 |
| X13SETT | 01.03.38 |
| X13SEVR-SP13F | 01.03.38 |
| X13OEI-CPU | 01.03.38 |
| B13DEE | 01.03.38 |
| B13DET | 01.03.38 |
| B13SEE-CPU-25G | 01.03.38 |
| B13SEG | 01.03.38 |
| B4SA1-CPU | 01.03.38 |
| B4SC1-CPU | 01.03.38 |
| H13QSH | 01.03.38 |
| H13SRH | 01.03.38 |
| H13SSF | 01.03.38 |
| H13SSH | 01.03.38 |
| G1SMH-G | 01.03.38 |
| G1SMH | 01.03.38 |
| G2DMH-G | 01.03.38 |
| G2DMH-GI | 01.03.38 |
| X13DEH | 01.03.38 |
| X13SAW-F | 01.03.38 |
| X13SAW-TLN4F | 01.03.38 |
| X13SCW-F-B | 01.03.38 |
| X13SCW-F | 01.03.38 |
| X13SCW-F | 01.03.38 |
| X14DBM-AP | 01.00.21.20 |
| X14DBM-SP | 01.00.21.20 |
| X14DBT-B | 01.00.21.20 |
| X14DBT-FAP | 01.00.21.20 |
| X14QBH+ | 01.00.21.20 |
| X14SBH-AP | 01.00.21.20 |
| X14SBH | 01.00.21.20 |
| X14SBM-TF | 01.00.21.20 |
| X14SBM-TP4F | 01.00.21.20 |
| X14SDV-20C-SP3F | 01.00.21.20 |
| X14SDV-32C-SP3F | 01.00.21.20 |
| X14SDV-36C-SP3F | 01.00.21.20 |
| X14SDV-36CE-SP3F | 01.00.21.20 |
| X14SDV-42C-SP3F | 01.00.21.20 |
| H13DSGM | 01.03.38 |
| B3SD1-20C-25G | 01.05.21 |
| B14DBE | 01.00.21.21 |
| B14DBT | 01.00.21.21 |
| B14SBE-CPU-25G | 01.00.21.21 |
| B14SBE-CPU-AP | 01.00.21.21 |
| X14DBG-GD | 01.00.21.20 |
| X14DBG-XAP | 01.00.21.20 |
| X14SBT-G | 01.00.21.20 |
| X14SBT-GAP | 01.00.21.20 |
| X14SBHM | 01.00.21.20 |
| H14DST-F | 01.00.21.20 |
| MBB-CMM-6 | 01.01.05 |
| MBM-CMM-6 | 01.01.05 |
| X11SSW-F-B | 4.10 |
| X11SSW-F | 4.10 |
| X11SSW-F | 4.10 |
| X11DPFF-SNR | 1.01.25 |
| X11DPT-BR | 1.01.25 |
Remediation:
All affected Supermicro motherboard SKUs will require a BMC update to mitigate these potential vulnerabilities.
An updated BMC firmware has been created to mitigate these potential vulnerabilities. Please check Release notes for the resolution.
As an immediate workaround to reduce the attack surface, it is advised to follow the BMC Configuration Best Practices Guide.
Exploitation and Public Announcements:
Supermicro is not aware of any malicious use of these vulnerabilities in the wild.