FreeIPMI ipmi-oem: stack buffer over-read when a BMC returns a short Fujitsu SEL response

Impact

FreeIPMI is the tooling most fleets script BMC work with, so this runs on the management host that talks to every node's service processor. When a BMC answers the Fujitsu OEM SEL long-text command with a response shorter than expected, ipmi_oem_fujitsu_get_sel_entry_long_text reads past the end of a stack buffer. The rated impact is availability only: the collection tool dies, not the node, so the practical loss is a broken SEL sweep or monitoring run rather than a compromised host. This is a distinct bug from CVE-2026-50031, which affects different versions, so patching for that one does not cover this.

Who can reach it

Whatever answers the IPMI session the operator opens: a malfunctioning or hostile BMC, or anyone positioned to respond on the management VLAN. No authentication against the tool is involved; the operator running ipmi-oem against that target is the trigger.

What to do

Upgrade FreeIPMI to 1.6.19 (source tarball on ftp.gnu.org, or your distribution's backport). This is a command-line tool, so it is a package update in place on management hosts and jump boxes: no daemon to restart, no GPU node downtime.

References

Related entries

• RoCEv2 lossless Ethernet fabric - IEEE 802.1Qbb Priority Flow Control: RoCE requires a lossless network, which inNCVD-2018-001-rocev2-lossless-ethernet-fabric · RoCEv2 lossless Ethernet fabric - IEEE 802.1Qbb Priority Flow ControlHigh
• RoCEv2 lossless Ethernet fabric - IEEE 802.1Qbb Priority Flow Control: RoCE requires a lossless network, which inNCVD-2018-006-rocev2-lossless-ethernet-fabric · RoCEv2 lossless Ethernet fabric - IEEE 802.1Qbb Priority Flow ControlHigh
• InfiniBand/RoCE Communication Manager (CM) and RNIC connection-state resources: RNICs hold per-connection state in aNCVD-2021-005-infiniband-roce-communication-ma · InfiniBand/RoCE Communication Manager (CM) and RNIC connection-state resourcesHigh
• InfiniBand/RoCE Communication Manager (CM) and RNIC connection-state resources: RNICs hold per-connection state in aNCVD-2021-011-infiniband-roce-communication-ma · InfiniBand/RoCE Communication Manager (CM) and RNIC connection-state resourcesHigh
• OpenBMC bmcweb HTTP/1.1 Expect: 100-continue handling: bmcweb applies a 4 KB body limit to unauthenticated requestsNCVD-2026-001-openbmc-bmcweb-http-1-1-expect-1 · OpenBMC bmcweb HTTP/1.1 Expect: 100-continue handlingHigh
• OpenBMC bmcweb HTTP/2 Content-Length handling: bmcweb passes the client-supplied Content-Length straightNCVD-2026-002-openbmc-bmcweb-http-2-content-le · OpenBMC bmcweb HTTP/2 Content-Length handlingHigh