CVEvulnerability

CVE-2019-6260

9.8 CRITICAL Published 2019-01-22 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-01-22
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P

Description

The ASPEED ast2400 and ast2500 Baseband Management Controller (BMC) hardware and firmware implement Advanced High-performance Bus (AHB) bridges, which allow arbitrary read and write access to the BMC's physical address space from the host (or from the network in unusual cases where the BMC console uart is attached to a serial concentrator). This CVE applies to the specific cases of iLPC2AHB bridge Pt I, iLPC2AHB bridge Pt II, PCIe VGA P2A bridge, DMA from/to arbitrary BMC memory via X-DMA, UART-based SoC Debug interface, LPC2AHB bridge, PCIe BMC P2A bridge, and Watchdog setup.

Affected configurations

• aspeedtech ast2400 firmware • aspeedtech ast2500 firmware • netapp fas\/aff baseboard management controller

Related

Referenced by CWE · observed example (4)

  • CWE-1189 Improper Isolation of Shared Resources on System-on-a-Chip (SoC) weakness
  • CWE-1317 Improper Access Control in Fabric Bridge weakness
  • CWE-653 Improper Isolation or Compartmentalization weakness
  • CWE-657 Violation of Secure Design Principles weakness

References