Description

ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _get_dell_system_info_idrac_info in ipmi-oem/ipmi-oem-dell.c (idrac-info subcommand to dell get-system-info).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-04T05:17:16.290Z",
  "pubdate": "2026-09-04T05:17:16.290Z",
  "executiveSummary": "A critical security vulnerability identified as a stack-based buffer overflow exists within the ipmi-oem utility of FreeIPMI versions prior to 1.6.19.\nThe vulnerability resides specifically in the _get_dell_system_info_idrac_info function located within ipmi-oem/ipmi-oem-dell.c.\nThis flaw can be triggered when utilizing the idrac-info subcommand of the dell get-system-info module.\nAn unauthenticated or authenticated attacker capable of interacting with the affected IPMI service could potentially leverage this flaw to trigger memory corruption.\nSuccessful exploitation may lead to a denial-of-service condition or the potential for arbitrary code execution with the privileges of the executing process.\nThe risk is significant due to the nature of low-level system management tools which often operate with elevated system permissions.\nUsers are strongly advised to update to version 1.6.19 or later to remediate the underlying memory safety issue.",
  "technicalDetails": "The vulnerability is a classic stack-based buffer overflow stemming from improper bounds checking during the processing of iDRAC system information data.\nWithin the file ipmi-oem/ipmi-oem-dell.c, the function _get_dell_system_info_idrac_info fails to adequately validate the length of input data received from the iDRAC interface before copying it into a fixed-size stack buffer.\nWhen an attacker provides a crafted response or manipulates the communication channel to return data exceeding the allocated buffer size, the excessive data overflows the stack frame.\nThis overflow allows for the overwriting of critical stack metadata, including saved frame pointers and the return address of the function.\nThe attack flow initiates when the user invokes the 'dell get-system-info' command with the 'idrac-info' subcommand against a target IPMI implementation.\nAs the application processes the response packets from the hardware or a malicious mock server, the vulnerable function attempts to copy the payload into its local stack buffer.\nBy controlling the content of this overflow, an attacker can hijack the instruction pointer (RIP/EIP) upon function return.\nIf the attacker successfully redirects execution flow, they can execute arbitrary machine code (shellcode) or return-oriented programming (ROP) chains to bypass non-executable stack protections.\nThe memory corruption is localized to the stack context of the FreeIPMI process, but given that FreeIPMI is typically utilized for system administration and management, the process often runs with high system privileges.\nThe impact includes application crashes (DoS) or complete system compromise depending on the user context and system hardening measures such as Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP).\nBecause the function is part of the ipmi-oem module, the vulnerability is exposed whenever a user interacts with Dell-specific IPMI OEM extensions, making it accessible to any entity capable of communicating with the configured IPMI endpoint."
}