AMI MegaRAC SPx (IPMI handler): Buffer overflow in the BMC's IPMI message handler leading to code execution

Impact

Buffer overflow in the BMC's IPMI message handler leading to code execution or privilege escalation inside the BMC. This is the pre-Redfish legacy protocol that almost every fleet still leaves enabled for ipmitool-based power control and sensor scraping, so the exposed surface is usually larger than operators assume. A win here means the attacker controls power, console and firmware update paths for the node.

Who can reach it

Network-reachable IPMI service, no credentials required per AMI's own CVSS vector, but high attack complexity. Any host that can send IPMI RMCP+ traffic to UDP/623 on the BMC is in range - which is every host on the management VLAN, and in badly-built estates any host that can route there.

What to do

Firmware flash to SPx_12.7 / SPx_13.5, out-of-band per node, gated on ODM rebase. Unlike the network-stack bugs in this cluster there IS a meaningful config-only mitigation here: disable IPMI-over-LAN entirely and drive power/sensors through Redfish instead. That is a config change on the BMC, no reboot, no flash - but it breaks any ipmitool-based tooling in your provisioning and monitoring stack, so cost it as a tooling migration.

References