Description

OpenBMC's IPMI implementation, phosphor-net-ipmid, is vulnerable to a logic flaw where the authorization context of an existing session can be replaced with a target account while still maintaining the original integrity and encryption keys. Several downstream vendors implement phosphor-net-ipmid as their IPMI stack, such as NVIDIA and H3C. This issue effectively allows for privilege escalation without re-authentication.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-15T14:16:50.290Z",
  "pubdate": "2026-09-15T14:16:50.290Z",
  "executiveSummary": "A critical logic vulnerability exists within the phosphor-net-ipmid implementation of OpenBMC, impacting downstream vendors including NVIDIA and H3C. The vulnerability resides in the session management mechanism, specifically concerning the handling of authorization contexts for established IPMI sessions.\nThe flaw allows an attacker to manipulate the authorization state of an existing session, effectively substituting the current user context with that of a target account. Crucially, this transition occurs without requiring re-authentication and maintains the integrity and encryption keys associated with the original session.\nThis vulnerability constitutes a significant privilege escalation risk, as an attacker with an established low-privilege or even unauthenticated session context could potentially elevate their privileges to that of an administrative user. By exploiting this logic error, an attacker can bypass standard authentication controls, leading to unauthorized access, control of the baseboard management controller (BMC), and potential compromise of the host system. The issue represents a failure in state management within the IPMI stack, requiring strict adherence to session lifecycle integrity protocols to mitigate.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper state machine handling within the phosphor-net-ipmid service, specifically during the processing of IPMI session messages. In the affected implementation, the software fails to atomically bind the security context to the underlying transport session throughout its entire lifecycle. Instead, it allows for a decoupled update of the user authorization context while the session remains active.\nDuring normal operation, IPMI sessions are established using a series of handshake messages that negotiate cipher suites and verify credentials, resulting in a session object containing cryptographic keys (SIK) and user roles. The vulnerable logic allows a craftily manipulated packet to trigger a re-assignment of the user identity mapped to an existing session identifier (SessionID). Because the session state—specifically the integrity and encryption keys—is not invalidated or rotated upon a change in the user context, the session remains valid with the newly injected target account credentials.\nThe attack flow proceeds as follows: First, the attacker establishes a valid, legitimate session with the BMC using their own credentials or by intercepting a legitimate session initiation. Once the session is established and encryption/integrity keys are active, the attacker sends a sequence of IPMI commands specifically formatted to exploit the logic flaw in the session management code. These commands trigger an internal state transition within phosphor-net-ipmid that updates the session's 'authorized-user' field to a higher-privilege account (e.g., administrator).\nBecause the system fails to re-validate the session or force a re-authentication handshake, the IPMI service continues to process subsequent requests under the guise of the new user context, while still using the original session's encryption parameters. This circumvents the intended security controls that should bind a unique, authenticated user context to the entirety of a specific IPMI session's lifetime.\nThe vulnerable component is identified as the session management logic within phosphor-net-ipmid. This flaw exposes the system to remote exploitation via the IPMI protocol over the network. Post-exploitation, an attacker gains unauthorized access with elevated privileges, enabling full control over the BMC, which facilitates arbitrary command execution, hardware manipulation, and potentially host-level exploitation via the IPMI interface. The lack of proper cryptographic binding between the user session state and the active session context is the primary enabler of this privilege escalation primitive."
}