Description

ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer over-read in ipmi_oem_fujitsu_get_sel_entry_long_text in ipmi-oem/ipmi-oem-fujitsu.c when a BMC provides a short response, a different vulnerability than CVE-2026-50031 (which has different affected versions).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-04T05:17:16.170Z",
  "pubdate": "2026-09-04T05:17:16.170Z",
  "executiveSummary": "A stack-based buffer over-read vulnerability exists in the ipmi-oem component of FreeIPMI versions prior to 1.6.19. This vulnerability originates within the ipmi_oem_fujitsu_get_sel_entry_long_text function in ipmi-oem/ipmi-oem-fujitsu.c. The flaw is triggered when the Baseboard Management Controller (BMC) returns a response shorter than expected, causing the application to read memory beyond the allocated stack buffer boundaries. Successful exploitation of this vulnerability could lead to information disclosure from the process memory or induce a crash resulting in a denial-of-service condition. This issue is distinct from CVE-2026-50031. Given that IPMI services typically operate with elevated privileges, memory corruption vulnerabilities in this context present significant security risks, potentially allowing an attacker to intercept sensitive system metadata or disrupt critical management operations.",
  "technicalDetails": "The vulnerability is a classic stack-based buffer over-read located in the implementation of the Fujitsu-specific OEM IPMI command handling within FreeIPMI. The function ipmi_oem_fujitsu_get_sel_entry_long_text is responsible for parsing long text entries retrieved from the System Event Log (SEL) of a Fujitsu BMC. The root cause lies in improper input validation and lack of bounds checking on the size of the data returned by the BMC during the IPMI exchange.\nDuring the communication process, the application sends a request to the BMC and waits for a response. When the function processes the response packet, it assumes a minimum expected length for the payload. If a malicious or malformed BMC response provides a payload length that is insufficient or mismatches the expected structure defined in the protocol implementation, the function proceeds to perform memory read operations based on hardcoded offsets or inadequate length calculations. Because the destination buffer is located on the stack, the function reads adjacent stack memory into the local buffer or attempts to process data that extends past the end of the intended input buffer.\nThe attack flow begins when an attacker, who has the ability to interact with the BMC interface or perform a Man-in-the-Middle (MitM) attack between the management client and the BMC, injects a maliciously crafted response packet. When FreeIPMI invokes ipmi_oem_fujitsu_get_sel_entry_long_text to parse the incoming data, the function fails to verify that the bytes provided by the BMC align with the expected data structures. By providing a specifically crafted short response, the attacker causes the pointer to traverse beyond the valid memory region allocated for the response data.\nThis over-read can lead to two primary outcomes. First, the application may inadvertently include sensitive data residing on the stack—such as return addresses, saved registers, or local variable pointers—in its subsequent processing or output logs, leading to sensitive information leakage. Second, if the over-read causes the process to access unmapped memory or violate process memory protections, the application will terminate unexpectedly, resulting in a denial-of-service of the IPMI management utility. Because the affected component (ipmi-oem) is used for system management, exploiting this flaw does not necessarily require local authentication to the operating system, but does require interaction with the management interface, highlighting the importance of securing IPMI network exposure."
}