Executive brief
FreeIPMI is a suite of tools used by system administrators to monitor hardware health (like CPU temperature) and manage remote power for servers. A security flaw in the 'ipmi-oem' tool could allow a malicious or compromised server to crash the management software when it requests system information. This could disrupt server monitoring operations and potentially allow an attacker to execute unauthorized code on the administrator's machine.
Technical details
Multiple stack-based buffer overflows (CWE-121) exist in the ipmi-oem component of FreeIPMI before version 1.6.17. The vulnerabilities are located in the response parsing logic for three specific OEM subcommands: 'dell get-last-post-code', 'supermicro extra-firmware-info', and 'wistron read-proprietary-string'. An attacker acting as a malicious IPMI responder can send a specially crafted response message that exceeds the allocated stack buffer during processing. This can lead to a denial of service (crash) or potentially arbitrary code execution. The issue was fixed in version 1.6.17 by implementing proper bounds checking on response lengths.
Affected products
- GNU FreeIPMI before 1.6.17
Timeline
- 2026-03-11: disclosed: Vulnerability reported to developers by Zhihan Zheng
- 2026-03-23: patched: Fixed in FreeIPMI version 1.6.17
- 2026-03-24: advisory: CVE-2026-33554 published