Remote malware attacks possible with AMI MegaRAC BMC flaws

Newly discovered high- and critical severity vulnerabilities in the AMI MegaRAC Baseboard Management Controller software could be leveraged to facilitate remote sever takeovers and malware delivery, The Hacker News reports. Threat actors could chain the flaws, tracked as CVE-2023-34329 and CVE-2023-34330, to evade Redfish remote management interface authentication, as well as facilitate arbitrary code execution on BMC chips and the distribution of payloads that could not be remediated by reinstallation of operating system and replacement of hard drives, according to an Eclypsium report. Both vulnerabilities could also be used by attackers alongside CVE-2022-40258 to obtain BMC chip admin account passwords. Despite the lack of any evidence suggesting in-the-wild exploitation, potential attacks exploiting the flaws could allow long-term cyberespionage operations, researchers said. "These vulnerabilities pose a major risk to the technology supply chain that underlies cloud computing. In short, vulnerabilities in a component supplier affect many hardware vendors, which in turn can be passed on to many cloud services," added researchers.