AMD Satellite Management Controller Denial-of-Service Vulnerability via Redfish API Manipulation

A denial-of-service vulnerability has been identified in the Satellite Management Controller (SMC) of AMD Instinct MI300X accelerators. This issue arises from improper input validation, which may allow an attacker with privileges to use certain special characters in manipulated Redfish API commands. Such manipulation can cause service processes, like OpenBMC, to crash and reset, leading to a potential denial-of-service condition.

Impact

Exploitation of this vulnerability can cause service processes to crash and reset, disrupting normal operations and potentially leading to a denial-of-service condition.

Remediation

Users are advised to update AMD Instinct MI300X accelerators to version BKC 24.10 or later.