AI analysis
FreeIPMI before 1.6.19 contains a stack-based buffer overflow (CWE-121) in the function _get_dell_system_info_idrac_info in ipmi-oem/ipmi-oem-dell.c, the code that handles Dell OEM IPMI commands. The flaw is triggered when a user runs the 'idrac-info' subcommand of 'ipmi-oem dell get-system-info' against a Dell iDRAC/BMC, causing oversized data handled by that code path to overflow a stack buffer. A successful attack could crash the ipmi-oem tool or potentially allow arbitrary code execution with the privileges of the user running it (CVSS 9.8 critical, network vector, high confidentiality/integrity/availability impact). Anyone running a FreeIPMI release prior to 1.6.19 and using its Dell OEM commands against Dell iDRAC controllers is affected. No public proof-of-concept is known, it is not in CISA KEV, and EPSS puts 30-day exploitation probability at roughly 0.4%, so no exploitation has been reported yet.
What to do: Upgrade to FreeIPMI 1.6.19 or later, which fixes the overflow in ipmi-oem-dell.c. Until upgraded, avoid running 'ipmi-oem dell get-system-info idrac-info' against Dell iDRAC/BMC endpoints, particularly ones that are not fully trusted. Check installed FreeIPMI versions via your package manager and prioritize hosts where the tool is run interactively or by automation against Dell hardware.
Affected
| GNU FreeIPMI project FreeIPMI (ipmi-oem utility, Dell OEM get-system-info/idrac-info command) | all versions before 1.6.19 |
Estimated exposure
moderateon the order of 10,000-100,000 installations worldwide (no published install counts) — FreeIPMI is an open-source IPMI tool suite packaged in major Linux distributions and commonly deployed on servers and in HPC/data-center environments that manage Dell BMCs, so a rough mid-range estimate of tens of thousands of installed…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.