CVE-2023-2992 – An unauthenticated denial-of-service vulnerabil... (How to Fix)

Q: What is the severity of CVE-2023-2992?

CVE-2023-2992 has a CVSS score of 7.5 (HIGH). An unauthenticated denial-of-service vulnerability exists in Lenovo's SMM v1, SMM v2, and FPC management web servers that allows remote attackers to crash the management interface under crafted conditions. Affected systems include Lenovo servers with vulnerable SMM/FPC firmware versions. Rebooting the SMM or FPC restores access.

📋 TL;DR

An unauthenticated denial-of-service vulnerability exists in Lenovo's SMM v1, SMM v2, and FPC management web servers that allows remote attackers to crash the management interface under crafted conditions. Affected systems include Lenovo servers with vulnerable SMM/FPC firmware versions. Rebooting the SMM or FPC restores access.

💻 Affected Systems

Products:

Lenovo System Management Module (SMM) v1
Lenovo System Management Module (SMM) v2
Lenovo Flexible Port Configuration (FPC)

Versions: Specific vulnerable versions not detailed in advisory; check Lenovo advisory for exact versions

Operating Systems: Not OS-dependent - firmware vulnerability

Default Config Vulnerable: ⚠️ Yes

Notes: Affects management web server components in SMM/FPC firmware; physical servers with these components are vulnerable.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete unavailability of server management interface, requiring physical access to reboot SMM/FPC components, potentially disrupting server administration during critical operations.

🟠

Likely Case

Temporary loss of web-based management access until manual reboot of SMM/FPC components, disrupting remote server administration capabilities.

🟢

If Mitigated

No impact if management interfaces are properly segmented and protected behind network controls.

🌐 Internet-Facing: HIGH - Unauthenticated remote exploitation possible if management interfaces are exposed to untrusted networks.

🏢 Internal Only: MEDIUM - Internal attackers or compromised internal systems could exploit this to disrupt server management.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW - Unauthenticated and triggered by crafted conditions

Vulnerability requires crafted conditions but is unauthenticated; exact exploit details not publicly disclosed.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Check Lenovo advisory LEN-127357 for specific fixed firmware versions

Vendor Advisory: https://support.lenovo.com/us/en/product_security/LEN-127357

Restart Required: Yes

Instructions:

1. Access Lenovo advisory LEN-127357. 2. Identify affected SMM/FPC firmware versions. 3. Download and apply firmware updates from Lenovo support portal. 4. Reboot SMM/FPC components after update.

🔧 Temporary Workarounds

Network Segmentation

all

Restrict access to SMM/FPC management interfaces to trusted administrative networks only

Configure firewall rules to block untrusted access to SMM/FPC management ports (typically 80/443)

Access Control Lists

all

Implement IP-based access controls on management interfaces

Configure SMM/FPC web server to only accept connections from authorized management IP addresses

🧯 If You Can't Patch

Isolate management interfaces behind VPN/firewall with strict access controls
Implement network monitoring for unusual traffic patterns to management interfaces

🔍 How to Verify

Check if Vulnerable:

Check SMM/FPC firmware version against Lenovo advisory LEN-127357; if running vulnerable version and management interface is accessible, system is vulnerable.

Check Version:

Check via SMM/FPC web interface or use Lenovo management tools; specific command varies by product.

Verify Fix Applied:

Confirm firmware version has been updated to patched version listed in Lenovo advisory; test management interface functionality.

📡 Detection & Monitoring

Log Indicators:

SMM/FPC web server crash logs
Unexpected management interface restarts
Failed authentication attempts followed by service disruption

Network Indicators:

Unusual traffic patterns to management ports (80/443) followed by service unavailability
Crafted HTTP requests to SMM/FPC management endpoints

SIEM Query:

source="smm_logs" OR source="fpc_logs" AND (event="crash" OR event="restart") AND dest_port IN (80, 443)

📊 Metadata

CVE ID: CVE-2023-2992

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-405

Published: June 26, 2023

Last Updated: November 21, 2024

🔗 References

https://support.lenovo.com/us/en/product_security/LEN-127357 Vendor Advisory
https://support.lenovo.com/us/en/product_security/LEN-127357 Vendor Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-2992, you might also want to check these: