OpenIPMI before 2.0.36: Where this bites an operator is in test and CI infrastructure rather than production nodes

Impact

Where this bites an operator is in test and CI infrastructure rather than production nodes: ipmi_sim is what teams use to emulate BMCs when developing provisioning automation and firmware tooling. An attacker who can reach a simulator instance crashes it or, with luck, bypasses its authentication - and a compromised CI runner that builds and signs your provisioning images is a supply-chain foothold into the real fleet. The low probability of code execution is the honest read; the availability impact on a build pipeline is the likely one. An out-of-bounds array access on the authentication type in the ipmi_sim BMC simulator, with denial of service the likely outcome and authentication bypass or code execution possible at low probability.

Who can reach it

Network access to a running ipmi_sim instance. In most environments that is a developer workstation or a CI runner rather than the production management VLAN, but CI runners are frequently more reachable than people assume.

What to do

Package update to OpenIPMI 2.0.36 or later on any host running ipmi_sim - a distribution package update, no firmware and no reboot. The broader hygiene point: BMC simulators used in CI should not be reachable from anything but the test harness, and should not run on a host that also holds production BMC credentials or signing keys.

References