Description

ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info in ipmi-oem/ipmi-oem-dell.c (cmc-ipv6-info subcommand to dell get-system-info).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-04T05:17:16.570Z",
  "pubdate": "2026-09-04T05:17:16.570Z",
  "executiveSummary": "A critical stack-based buffer overflow vulnerability exists within the FreeIPMI software suite, specifically affecting the ipmi-oem component prior to version 1.6.19.\nThe vulnerability is localized within the _output_dell_system_info_cmc_ipv6_info function, which handles specific Dell-proprietary system information requests.\nSuccessful exploitation allows a local or remote attacker, depending on the service exposure, to trigger memory corruption by providing a specially crafted input string during a cmc-ipv6-info subcommand execution.\nThe primary impact of this flaw is the potential for arbitrary code execution or a denial-of-service condition through application crashing.\nThis vulnerability poses a significant security risk, as it allows for the subversion of process integrity. As FreeIPMI is often used in administrative and infrastructure management contexts, exploitation could result in the compromise of baseboard management controllers or the host environment executing the utility.\nAttackers require the ability to influence the input processed by the vulnerable function, which necessitates access to execute the ipmi-oem command-line interface with the Dell system information gathering parameters.",
  "technicalDetails": "The vulnerability is a classic stack-based buffer overflow located in the source file ipmi-oem/ipmi-oem-dell.c. The root cause lies in improper bounds checking during the parsing of IPv6 information returned by Dell Chassis Management Controller (CMC) devices.\nWithin the _output_dell_system_info_cmc_ipv6_info function, the implementation fails to adequately validate the length of input data received from the BMC/CMC before performing a memory copy operation into a fixed-size stack buffer. Because the destination buffer on the stack has a predefined size, supplying an oversized data payload results in an overflow condition.\nThe attack flow begins when a user invokes the ipmi-oem utility with the 'dell get-system-info' command sequence, specifically targeting the 'cmc-ipv6-info' subcommand. The utility initiates communication with the target IPMI/CMC interface. An attacker capable of manipulating the data stream—either via network-level interception (if communicating over an insecure transport) or by controlling a compromised BMC—injects a maliciously crafted payload that exceeds the capacity of the stack buffer.\nWhen the _output_dell_system_info_cmc_ipv6_info function processes this input, the overflow overwrites adjacent stack memory. In a standard exploitation scenario, an attacker would overwrite the saved Return Instruction Pointer (RIP/EIP) on the stack. By precisely controlling the data following the buffer, the attacker can redirect the program's control flow to arbitrary locations in memory, such as injected shellcode or existing Return-Oriented Programming (ROP) gadgets.\nThe vulnerable component is the ipmi-oem utility, part of the FreeIPMI suite, specifically in versions earlier than 1.6.19. The exploitation requirement assumes the utility is being run against a device or data source that an attacker can influence. Since FreeIPMI is frequently used for low-level server management, the privilege level of the process running this utility is often elevated, potentially allowing an attacker to escalate privileges or gain persistent control over the host system.\nMemory corruption via stack overflow is a well-documented vulnerability class. In this instance, because the overflow occurs during the processing of network-retrieved data, it serves as a critical entry point for compromising administrative infrastructure."
}