Description

FreeIPMI before 1.6.19 has a stack-based buffer overflow in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c via malformed Fujitsu SEL long-text responses.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-04T05:17:16.047Z",
  "pubdate": "2026-09-04T05:17:16.047Z",
  "executiveSummary": "A critical security vulnerability identified as a stack-based buffer overflow exists within the FreeIPMI library, specifically impacting the handling of Fujitsu-specific System Event Log (SEL) messages.\nThe vulnerability resides in the _ipmi_sel_oem_fujitsu_get_sel_entry_long_text function within libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c.\nSuccessful exploitation allows a remote or local attacker, capable of influencing the IPMI SEL data returned to the FreeIPMI client, to trigger an overflow condition.\nThe risk implication includes the potential for arbitrary code execution within the context of the process utilizing the library, leading to system compromise or service disruption.\nThe flaw is present in all FreeIPMI versions prior to 1.6.19.\nThe attack is contingent upon the processing of a malformed Fujitsu SEL long-text response, which likely occurs when an IPMI management tool queries the SEL from a managed device.\nGiven that FreeIPMI is frequently utilized for server management and infrastructure monitoring, this vulnerability poses a significant threat to data center security, potentially enabling lateral movement if an attacker compromises a managed BMC (Baseboard Management Controller) to send malicious responses to monitoring software.",
  "technicalDetails": "The vulnerability is a classic stack-based buffer overflow stemming from improper bounds checking when processing OEM-specific SEL entries provided by Fujitsu iRMC (integrated Remote Management Controller) systems.\nThe root cause is located in the function _ipmi_sel_oem_fujitsu_get_sel_entry_long_text defined in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c. This function is responsible for parsing and formatting long-text descriptions associated with SEL events unique to Fujitsu hardware implementations.\nDuring the parsing process, the library fails to adequately validate the length of the data retrieved from the IPMI response packet before copying it into a fixed-size stack buffer. An attacker can craft a malicious Fujitsu SEL entry that exceeds the allocated buffer capacity, leading to the corruption of adjacent stack memory.\nThe exploitation flow begins when the FreeIPMI library communicates with a BMC to retrieve event logs. If the BMC is compromised or a rogue device is introduced, it can respond to an IPMI 'Get SEL Entry' request with a crafted long-text field. When the FreeIPMI client attempts to parse this specific OEM entry, the vulnerable function performs an insecure memory copy operation. By providing a payload that exceeds the destination buffer length, the attacker overwrites the saved return address or other critical control flow data on the stack.\nUpon function return, the execution flow is redirected to an attacker-controlled memory address, facilitating arbitrary code execution. Because this library is commonly linked into administrative management tools, successful exploitation typically runs with the privileges of the user executing the FreeIPMI tool. If these tools are executed with elevated system or root privileges, the impact includes full system compromise.\nAffected versions include all releases of FreeIPMI prior to 1.6.19. The vulnerability is triggered during the standard retrieval and parsing of SEL data via the IPMI protocol. No authentication is inherently required at the library level, as the vulnerability is triggered by data received during the normal event log monitoring process, making the security of the BMC hardware an implicit requirement for system integrity.\nThis vulnerability highlights the dangers of trust-based parsing where OEM-specific data extensions are not subjected to the same rigorous length validation as standard IPMI fields."
}