Description

ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_info in ipmi-oem/ipmi-oem-dell.c (cmc-info subcommand to dell get-system-info).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-04T05:17:16.433Z",
  "pubdate": "2026-09-04T05:17:16.433Z",
  "executiveSummary": "A critical stack-based buffer overflow vulnerability exists in the ipmi-oem utility of the FreeIPMI software suite, specifically affecting versions prior to 1.6.19.\nThe vulnerability resides within the '_output_dell_system_info_cmc_info' function located in 'ipmi-oem/ipmi-oem-dell.c', which handles the processing of chassis management controller (CMC) information for Dell systems.\nSuccessful exploitation allows a local or remote attacker to trigger memory corruption, potentially leading to arbitrary code execution with the privileges of the FreeIPMI process.\nThe flaw stems from improper boundary checking during the processing of system information data provided by the hardware.\nRisk implications are significant, as exploitation could result in complete compromise of the system running the IPMI utility, facilitating unauthorized access, data exfiltration, or denial-of-service conditions.\nThe attack is contingent upon the attacker's ability to supply malformed or malicious CMC information that exceeds the allocated stack buffer during the parsing routine.",
  "technicalDetails": "The vulnerability is classified as a stack-based buffer overflow originating from insufficient input validation in the '_output_dell_system_info_cmc_info' function. This function is responsible for parsing and outputting CMC information retrieved via the 'cmc-info' subcommand for Dell-specific system information requests.\nThe root cause is identified as an unsafe memory operation where the software copies data into a fixed-size buffer on the stack without performing adequate length verification. When the IPMI responder returns a Dell-specific information packet containing a payload length exceeding the capacity of the destination buffer, the stack-allocated memory is overwritten.\nThe exploitation flow begins when a user invokes the 'ipmi-oem' command with the 'dell get-system-info' (specifically the 'cmc-info' subcommand) against a malicious or compromised IPMI interface. Upon receiving the response from the BMC (Baseboard Management Controller), the 'ipmi-oem' utility passes the raw data to the '_output_dell_system_info_cmc_info' function. Due to the lack of bounds checking, the application copies the incoming packet data past the end of the stack buffer.\nBy crafting a malicious packet, an attacker can overwrite critical stack data, including the function return address or saved frame pointers. This allows the attacker to redirect the instruction pointer (EIP/RIP) to execute arbitrary code or shellcode embedded within the crafted payload. If the application is running with elevated privileges (e.g., as root for hardware access), the resulting shellcode will execute with those same privileges, leading to full system compromise.\nThe vulnerability affects all versions of FreeIPMI prior to 1.6.19. Since IPMI utilities often operate on raw network traffic between the management console and the BMC, the exposure is network-dependent. Authentication requirements for triggering this vulnerability depend on the IPMI configuration; if the IPMI interface allows unauthenticated access or the attacker has gained valid credentials, they can trigger the overflow by responding to the 'cmc-info' request with a malformed packet.\nPost-exploitation impact includes the potential for persistent system access, lateral movement within the network, or the ability to perform further hardware-level manipulation via the compromised IPMI interface."
}