OpenBMC bmcweb multipart_parser (Redfish / web UI HTTP front end): bmcweb is the single process behind Redfish, the web

Impact

bmcweb is the single process behind Redfish, the web UI, serial-over-LAN and the KVM websocket - kill it and you lose every out-of-band control path at once. A multipart form body containing a long header line with no colon writes one byte off the end of a heap buffer, and the write can be repeated in a loop. The reported outcome is denial of service, but the advisory classifies it as both heap and stack out-of-bounds writes reachable without authentication, which is a materially worse posture than the DoS framing suggests. Fleet impact: an unauthenticated source on the management VLAN can flatten Redfish on every ASPEED node.

Who can reach it

Unauthenticated HTTP(S) to bmcweb on the BMC's management interface. Multipart upload endpoints are reachable pre-auth in affected versions, so no credentials and no host access are needed.

What to do

Fixed in bmcweb 2.13 / OpenBMC 2.13 (Gerrit 56796 and 56868). Delivery is a BMC firmware flash - per node, out-of-band, and gated on when your ODM last rebased bmcweb, which for many server vendors is a long time. Check the bmcweb version your image reports before assuming you are covered. Config-only mitigation: restrict which hosts can reach the BMC's HTTPS port to your management jump boxes, which is the same control that limits half of this cluster.

References