Executive brief
FreeIPMI's ipmi-oem tool is used to run vendor-specific IPMI commands for system management on Dell servers. A stack-based buffer overflow in the Dell system information handler allows attackers to crash the tool or execute arbitrary code when requesting Dell iDRAC system information, potentially compromising server management capabilities.
Technical details
The vulnerability is a stack-based buffer overflow in the _get_dell_system_info_idrac_info function within ipmi-oem/ipmi-oem-dell.c, triggered by the idrac-info subcommand to the dell get-system-info command. The overflow occurs due to insufficient bounds checking when processing Dell iDRAC system information responses. An attacker with network access to an IPMI interface (or local access to the system running ipmi-oem) can supply a malformed response to trigger the overflow, leading to denial of service or arbitrary code execution. The vulnerability affects FreeIPMI versions before 1.6.19, which includes the fix.
Affected products
- GNU FreeIPMI before 1.6.19
Timeline
- 2026-09-04: disclosed
- 2026-08-27: patched: FreeIPMI 1.6.19 released