Dell iDRAC Service Module (iSM): Buffer access with incorrect length in the in-band agent gives a low-privileged local

Impact

Buffer access with incorrect length in the in-band agent gives a low-privileged local attacker code execution and elevation on the host OS. iSM is the bridge between host and BMC, so it is a stepping stone from tenant workload toward out-of-band control.

Who can reach it

Any low-privilege local account on the server OS - including a container that escaped to the host.

What to do

Upgrade iSM to 6.0.3.0. Host package update plus service restart, no reboot and no firmware flash. Cheap - do it in the normal patch cycle. If you do not actually consume iSM telemetry, uninstall it instead.

References