Divulgation de la vulnérabilité :
L'objectif de cette divulgation est de communiquer les vulnérabilités potentielles affectant Supermicro qui ont été signalées par un chercheur externe.
Remerciements :
Supermicro would like to acknowledge the work done by a researcher from China, Eason and vul_pwner, for discovering potential vulnerabilities in the Supermicro BIOS Firmware.
Les résultats :
Supermicro is aware of the following potential vulnerabilities in the BIOS firmware. Improper input validation in the Supermicro BIOS may allow arbitrary memory write which can be potentially exploited.
CVEs et produits affectés :
| ID CVE | Score CVSS | Type de vulnérabilité | Cartes mères concernées | Version du BIOS avec correction |
|---|---|---|---|---|
| 36433 | Haut (7,5) | Écriture mémoire arbitraire |
| v 4.4 |
| 36434 | Haut (7,5) | Appel SMM |
| v 4.4 |
| 36432 | Haut (7,5) | Écriture mémoire arbitraire |
| v 4.4 |
Atténuation :
Supermicro has created a fix to mitigate these potential vulnerabilities. Affected motherboards are being validated. Please check the release notes for resolution.
Exploitation et annonce publique :
Supermicro is not aware of any public announcements or malicious use of the vulnerabilities described in this advisory.