AI analysis
FreeIPMI versions before 1.6.19 contain a stack-based buffer overflow (CWE-121) in the function _ipmi_sel_oem_fujitsu_get_sel_entry_long_text in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c, which decodes Fujitsu iRMC OEM System Event Log (SEL) entries into long text descriptions. The flaw is triggered when FreeIPMI processes a malformed or oversized SEL long-text response supplied by a Fujitsu iRMC BMC, for example when the tool queries a compromised or spoofed BMC on the management network. With a CVSS 3.1 score of 9.8 (network vector, no privileges or user interaction required), a successful attack can compromise confidentiality, integrity, and availability, most plausibly through a crash or code execution in the process parsing the response. Anyone running FreeIPMI prior to 1.6.19 and using it to manage or monitor Fujitsu PRIMERGY servers with iRMC controllers is affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known; EPSS estimates a 0.4% probability of exploitation within 30 days (32nd percentile).
What to do: Upgrade to FreeIPMI 1.6.19 or later, or install a distribution security update with the fix backported. Until patched, avoid running SEL decoding/queries (e.g., ipmi-sel) against Fujitsu iRMC BMCs and restrict the IPMI management network (UDP 623) to trusted hosts. Audit which hosts have FreeIPMI installed and whether they are used to monitor Fujitsu PRIMERGY/iRMC hardware.
Affected
| GNU FreeIPMI project FreeIPMI (Fujitsu iRMC SEL long-text decoding path) | all versions before 1.6.19 |
Estimated exposure
largeon the order of tens of thousands of management/monitoring hosts — FreeIPMI ships in major Linux distribution repositories and is a standard open-source BMC/SEL management tool in data centers and HPC clusters (especially Fujitsu PRIMERGY/iRMC fleets), but no public install counts exist, so this is a…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.