Lenovo / IBM Integrated Management Module 2 (IMM2) web administration service: The overflow is inside the

Impact

The overflow is inside the authentication routine itself, so a crafted user ID and password pair corrupts the BMC's stack before any credential decision is made - no account needed. Successful exploitation is control of the management controller: power state, virtual media, host firmware, serial console. The pattern is worth naming for anyone building a BMC risk model, because it recurs across vendors and a decade: the code that parses the login attempt is the least-privileged-input, highest-privilege-context code on the device, and it is repeatedly written in C against fixed buffers. Same shape as the Supermicro login.cgi overflow four years earlier.

Who can reach it

Network, pre-auth. Any reachability to the IMM2 web administration service.

What to do

Flash IMM2 firmware to 4.70+ (Lenovo-branded servers) or 6.60+ (IBM-branded). Out-of-band update, node drain not strictly required but advisable since the IMM restarts. As with every pre-auth BMC bug in this catalogue, the flash is the fix and network isolation is the control that makes the flash schedulable rather than an emergency: if the BMC is only reachable from a bastion, an unpatched pre-auth overflow is a risk you can plan around; if it is reachable from a tenant VLAN or the internet, it is not.

References