Описание
ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info in ipmi-oem/ipmi-oem-dell.c (cmc-ipv6-info subcommand to dell get-system-info).
A stack-based buffer overflow exists in FreeIPMI's ipmi-oem tool, in the Dell OEM handler for the get-system-info cmc-ipv6-info subcommand. The vulnerable function _output_dell_system_info_cmc_ipv6_info uses a 256-byte stack buffer but allows up to 65536 bytes of data to be copied from a BMC response without proper bounds checking.
Отчет
This flaw has limited practical impact for several reasons: (1) ipmi-oem is a client-side command-line tool run manually by administrators, not a listening service or daemon — exploitation requires a user to actively run the specific Dell OEM subcommand against a compromised or malicious BMC; (2) IPMI communication typically occurs over a dedicated out-of-band management network, not the general Internet; (3) Red Hat Enterprise Linux builds FreeIPMI with full hardening enabled (_hardened_build 1), including stack protector (-fstack-protector-strong), which detects stack buffer corruption and terminates the process before the return address can be hijacked — effectively limiting the impact to a client-side crash rather than code execution; (4) additional mitigations including PIE, full RELRO, and NX further hinder exploitation even if the stack canary were bypassed. Fix is available in FreeIPMI version 1.6.19.
Меры по смягчению последствий
Do not run ipmi-oem dell get-system-info subcommands (specifically idrac-info, cmc-info, and cmc-ipv6-info) against untrusted or unverified BMC endpoints. Restrict IPMI management network access to trusted administrators and trusted BMC controllers only. If the ipmi-oem Dell OEM subcommands are not needed, avoid using them entirely.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | freeipmi | Affected | ||
| Red Hat Enterprise Linux 6 | freeipmi | Out of support scope | ||
| Red Hat Enterprise Linux 7 | freeipmi | Affected | ||
| Red Hat Enterprise Linux 8 | freeipmi | Affected | ||
| Red Hat Enterprise Linux 9 | freeipmi | Affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info in ipmi-oem/ipmi-oem-dell.c (cmc-ipv6-info subcommand to dell get-system-info).
ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info in ipmi-oem/ipmi-oem-dell.c (cmc-ipv6-info subcommand to dell get-system-info).
ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info in ipmi-oem/ipmi-oem-dell.c (cmc-ipv6-info subcommand to dell get-system-info).
ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow i ...
ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info in ipmi-oem/ipmi-oem-dell.c (cmc-ipv6-info subcommand to dell get-system-info).
EPSS
7.5 High
CVSS3