OpenBMC phosphor-net-ipmid (IPMI 2.0 RMCP+ / IPMI over LAN): The headline OpenBMC bug

CVSS 10.0CVE-2021-39296Firmware, BMC & network fabricGHSA-gg9x-v835-m48qcurated

Impact

The headline OpenBMC bug. Crafted IPMI session-setup messages skip authentication entirely and hand the attacker full administrative control of the BMC - no credentials, no prior access, just UDP packets at the management interface. From there: power-cycle any node, mount virtual media, install BMC-resident firmware that survives host reimage, and pivot onto the host. On a GPU cluster where the management VLAN reaches every node, one packet source that can see that VLAN owns the fleet's out-of-band plane. CVSS 10.0 with scope change, which is rare and deserved. Google's security team reported it; Intel shipped it as SA-00737.

Who can reach it

Network access to the BMC's IPMI-over-LAN port (UDP 623). Unauthenticated. In practice: anyone who reaches the management VLAN - a misrouted tenant network, a jump host, a compromised switch, or a BMC accidentally exposed to the internet.

What to do

Fixed in OpenBMC after 2.9. Getting the fix onto nodes is a BMC firmware flash: out-of-band, per node, ODM-rebase-lagged, brick risk. But the config-only mitigation here is strong and should be done first, today: disable IPMI over LAN entirely and use Redfish. OpenBMC's Redfish support has been production-ready for years and most fleets no longer need RMCP+. If you cannot disable it, ACL UDP 623 so only your management jump hosts can reach it. Check your fleet for BMCs reachable outside the management VLAN before doing anything else.

References

https://nvd.nist.gov/vuln/detail/CVE-2021-39296 https://github.com/google/security-research/security/advisories/GHSA-gg9x-v835-m48q https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00737.html

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.