GNU FreeIPMI's ipmi-oem tool before version 1.6.17: The direction of trust is what makes this operator-relevant

Impact

The direction of trust is what makes this operator-relevant: the vulnerability is in the management station, not the managed node. A malicious or compromised BMC sends a crafted response and corrupts memory in the tool running on your management host. In a fleet that means one compromised BMC can attack the machine that polls every other BMC - so the blast radius of a single bad node extends to your entire out-of-band control plane, including whatever credentials that host holds for the rest of the fleet. Exploitable buffer overflows in the parsing of IPMI response messages, i.e. the client trusts what the BMC sends back.

Who can reach it

Requires the operator's own tooling to talk to a hostile IPMI responder. That happens when a BMC has already been compromised, when a node of unknown provenance is brought into the fleet, or when an attacker on the management VLAN can spoof or intercept IPMI responses - which the weak IPMI session security elsewhere in this list makes plausible.

What to do

Package update of FreeIPMI to 1.6.17 or later on every management host, monitoring collector and provisioning box that runs ipmi-oem. This is an ordinary distribution package update, so rollout is cheap - no firmware flash, no node reboot, no maintenance window - which makes it one of the few items here you can just fix. The architectural follow-up worth doing: run fleet IPMI polling from a host that holds no other credentials, so a compromise of the poller does not hand over the whole management plane.

References