Description

FreeIPMI before 1.6.19 has a stack-based buffer overflow in _read_fru_data in libfreeipmi/fru/ipmi-fru.c when a BMC returns more bytes than requested.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-04T05:17:16.723Z",
  "pubdate": "2026-09-04T05:17:16.723Z",
  "executiveSummary": "A critical stack-based buffer overflow vulnerability exists in FreeIPMI versions prior to 1.6.19. This flaw originates within the _read_fru_data function during the processing of Field Replaceable Unit (FRU) data received from a Baseboard Management Controller (BMC).\nThe vulnerability allows for memory corruption if a malicious or compromised BMC returns a data payload exceeding the size requested by the client application. By supplying oversized data, an attacker can overwrite memory segments on the stack.\nThe impact of this vulnerability includes potential arbitrary code execution, denial-of-service conditions through application crashes, or the subversion of application logic. This poses a significant risk to systems relying on FreeIPMI for hardware monitoring and management, particularly in environments where BMC integrity cannot be guaranteed or where the management network is exposed to potentially hostile devices.\nExploitation requires an attacker to interact with the target system via the IPMI protocol or to control the BMC device providing the responses to FreeIPMI queries. No specific authentication to the host OS is required, though the attacker must be capable of positioning themselves as a BMC responder or compromising a BMC accessible to the victim system.",
  "technicalDetails": "The vulnerability resides in libfreeipmi/fru/ipmi-fru.c within the function _read_fru_data. The root cause is a failure to perform adequate bounds checking on the size of the data returned by the BMC relative to the size of the destination stack buffer allocated to store the FRU information.\nDuring the standard IPMI FRU data retrieval process, the client requests specific blocks of data from the BMC. If the BMC implementation is either faulty or malicious, it may return a response size larger than the buffer defined in the _read_fru_data function. Because the function utilizes standard memory copying routines without verifying that the source length is constrained by the destination buffer size, the excessive data overflows the stack frame.\nThe attack flow proceeds as follows: 1. The attacker triggers an IPMI command (such as 'ipmi-fru') that causes the client to request FRU data from a BMC. 2. The attacker intercepts or controls the BMC's response, injecting a payload that exceeds the expected maximum size of the response buffer. 3. The _read_fru_data function processes the response, copying the data into the local stack-allocated buffer. 4. The overflow corrupts the return address or local variables on the stack frame. 5. Upon the function's return, control flow is hijacked, potentially redirecting execution to attacker-controlled shellcode or an ROP (Return-Oriented Programming) chain.\nThe vulnerability is limited to software versions prior to 1.6.19. As this is a client-side library issue, the primary exposure involves local or networked tools using the libfreeipmi library to communicate with BMCs. While BMCs are traditionally isolated, vulnerabilities in the IPMI implementation allow for lateral movement or host compromise from a compromised hardware management interface.\nThe payload behavior is dependent on the architecture and compiler protections (such as stack canaries or ASLR) enabled on the host system. Without protections, the overflow can easily be turned into arbitrary code execution. Even with protections, a sophisticated attacker might use an information leak to bypass ASLR or target non-protected function pointers to gain control of the execution flow."
}