Executive brief
FreeIPMI is a software suite used to manage and monitor server hardware, such as checking CPU temperatures or remotely controlling power. A security vulnerability was found in its 'ipmi-oem' tool, which handles specialized commands for hardware from vendors like Dell and Fujitsu. If an attacker can send a specially crafted response from a server or management controller, they can cause the tool to crash or potentially take control of the system running the software. This could lead to a denial of service or unauthorized access to management operations.
Technical details
Multiple stack-based buffer overflows (CWE-121) exist in the ipmi-oem component of FreeIPMI before version 1.6.18. The vulnerabilities are located in the 'ipmi_oem_dell_get_active_directory_config' and 'ipmi_oem_fujitsu_get_sel_entry_long_text' functions. In the Dell implementation, the caller allocates a 256-byte stack buffer but passes an oversized protocol maximum (65536) as the destination length to a helper function, allowing a multi-chunk response to overflow the buffer. In the Fujitsu implementation, insufficient bounds checking on the 'data_length' field from a response message allows for a similar overflow during a memcpy operation. An attacker controlling a BMC or a malicious IPMI endpoint can trigger these overflows to crash the client process or achieve remote code execution. The issue is resolved in FreeIPMI version 1.6.18.
Affected products
- GNU FreeIPMI before 1.6.18
Timeline
- 2026-05-18: disclosed: Vulnerability reported to maintainers via GNU Savannah bug tracker.
- 2026-06-02: patched: FreeIPMI version 1.6.18 released with fixes.
- 2026-06-03: advisory: CVE-2026-50031 published.