Executive brief
FreeIPMI is a library and set of tools for IPMI (Intelligent Platform Management Interface) communication with server hardware, including remote monitoring and power control. A stack-based buffer overflow in the FRU (Field Replaceable Unit) data parsing function allows a malicious or compromised BMC (Baseboard Management Controller) to crash the application or execute arbitrary code by returning more data than requested.
Technical details
A stack-based buffer overflow exists in the _read_fru_data function within libfreeipmi/fru/ipmi-fru.c when a BMC returns more bytes than requested in response to an FRU data query. The vulnerable code fails to validate the response size before writing to a fixed-size stack buffer, allowing an out-of-bounds write. The attack vector requires network-level access to the BMC interface (IPMI over LAN) or local access if using in-band IPMI communication. An attacker controlling or compromising the BMC can trigger this condition to cause denial of service or achieve code execution. The vulnerability is fixed in FreeIPMI version 1.6.19 and later.
Affected products
- GNU FreeIPMI before 1.6.19
Timeline
- 2026-08-27: patched: FreeIPMI 1.6.19 released
- 2026-09-04: disclosed