Hi, like many of you I have purchased some Gigabyte motherboards that were featured here (MJ11-EC1, MC12-LE0).
The BMC on these motherboards runs Linux:
I consider it due diligence to request GPL source code from vendors, especially in light of recent disclosures that BMC firmwares from several major vendors such as Intel and Lenovo did not incorporate security fixes in lighttpd:
arstechnica.com
So I requested the source code for the BMC firmware from Gigabyte eSupport in January 2024.
When they did not follow up for several months, I asked them again in May 2024 and received this response:
Would someone with an ear inside Gigabyte mind telling them how foolish (and license infringing) the above response is?
Otherwise I'm going to start the long and painful journey of contacting copyright holders and going the FSF/SFC legal route because I'm so extremely tired of vendors ignoring their open-source licenses obligations in the year of our RCE, 2024.
@Patrick it would be so, so amazing if for future hardware reviews, you made it a point to ask the vendor where customers/users can obtain the GPL source code. It's a small question to ask but will make a big difference if vendors realize that customers are expecting them to provide it.
Everyone is pearl clutching about supply chain attacks but the brutal truth is that no one is checking their supply chain. This is even harder to do when vendors willfully violate open source licenses and refuse to provide the source code.
The BMC on these motherboards runs Linux:
Code:
$ binwalk 126121.bin
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
163848 0x28008 CRC32 polynomial table, little endian
213604 0x34264 CRC32 polynomial table, little endian
393216 0x60000 JFFS2 filesystem, little endian
5636096 0x560000 CramFS filesystem, little endian, size: 40951808, version 2, sorted_dirs, CRC 0x417607BC, edition 0, 27801 blocks, 6575 files
46596160 0x2C70040 uImage header, header size: 64 bytes, header CRC: 0x596F847A, created: 2024-03-12 06:08:06, image size: 2792592 bytes, Data Address: 0x80008000, Entry Point: 0x80008000, data CRC: 0xC9C2F025, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: "Linux-3.14.17-ami"
46596224 0x2C70080 Linux kernel ARM boot executable zImage (little-endian)
46613079 0x2C74257 gzip compressed data, maximum compression, from Unix, last modified: 1970-01-01 00:00:00 (null date)
49479680 0x2F30000 JFFS2 filesystem, little endian
50003968 0x2FB0000 CramFS filesystem, little endian, size: 5963776, version 2, sorted_dirs, CRC 0xBCBB0E63, edition 0, 1566 blocks, 131 filesHackable Intel and Lenovo hardware that went undetected for 5 years won’t ever be fixed
Multiple links in the supply chain failed for years to identify an unfixed vulnerability.
arstechnica.com
So I requested the source code for the BMC firmware from Gigabyte eSupport in January 2024.
When they did not follow up for several months, I asked them again in May 2024 and received this response:
I do not work for a company with a business relationship with Gigabyte, but I know people here do.
Would someone with an ear inside Gigabyte mind telling them how foolish (and license infringing) the above response is?
Otherwise I'm going to start the long and painful journey of contacting copyright holders and going the FSF/SFC legal route because I'm so extremely tired of vendors ignoring their open-source licenses obligations in the year of our RCE, 2024.
@Patrick it would be so, so amazing if for future hardware reviews, you made it a point to ask the vendor where customers/users can obtain the GPL source code. It's a small question to ask but will make a big difference if vendors realize that customers are expecting them to provide it.
Everyone is pearl clutching about supply chain attacks but the brutal truth is that no one is checking their supply chain. This is even harder to do when vendors willfully violate open source licenses and refuse to provide the source code.
Last edited:
