FreeIPMI ipmi-oem: stack overflow parsing Dell get-system-info responses returned by a BMC

Impact

The Dell OEM handlers in ipmi-oem/ipmi-oem-dell.c copy response data from the BMC into fixed stack buffers without bounding it, so a BMC that answers dell get-system-info with an oversized or malformed payload overflows the stack of the tool running on the management host. This is the wrong direction of trust for a datacenter: the inventory collector, the burn-in script or the fleet-management agent that polls every node's iDRAC becomes the target, and one hostile or tampered BMC can attack the host that talks to all of them. The vendor split this across three ids - CVE-2026-85506 (idrac-info), CVE-2026-85507 (cmc-info) and CVE-2026-85508 (cmc-ipv6-info) - all the same unbounded copy in the same file, fixed in the same release; they are written here as one entry because an operator takes exactly one action for all three.

Who can reach it

Whoever controls or can impersonate the BMC being queried: a compromised iDRAC/CMC, or an attacker on the management VLAN able to answer IPMI traffic where session integrity is not enforced. Exploitation requires that an operator or automation actually run ipmi-oem dell get-system-info against the attacker-controlled endpoint - it is not reachable unprompted.

What to do

Upgrade FreeIPMI to 1.6.19 (GNU release tarball linked on the record) or take the distro backport; this is a package update of a command-line tool and its library, so no node drain or BMC firmware flash is involved. Until then, avoid running the Dell OEM subcommands against BMCs you do not fully trust, and keep the management network isolated so responses cannot be spoofed.

Also covers 2 CVEs

The vendor assigned a separate id to each affected code path. They share this advisory, this score and this fix, so they are one entry here.

References

Related entries

• FreeIPMI FRU reader: stack overflow when a BMC returns more FRU bytes than requestedCVE-2026-85509 · FreeIPMI libfreeipmi FRU reader (_read_fru_data)Critical
• Supermicro IPMI BMC firmware (WPCM450 / X8-X9 generation): An unauthenticated HTTP GET for /PSBlock on port 49152NCVD-2014-001-supermicro-ipmi-bmc-firmware-wpc · Supermicro IPMI BMC firmware (WPCM450 / X8-X9 generation)Critical
• Dell iDRAC9 (Virtual Console / authentication): An attacker with no credentials lands directly inside the server'sCVE-2021-21538 · Dell iDRAC9 (Virtual Console / authentication)Critical
• Dell iDRAC9 (VNC server): Unauthenticated access to the iDRAC VNC consoleCVE-2022-24422 · Dell iDRAC9 (VNC server)Critical
• AMI MegaRAC SPx 12 / SPx 13 (BMC network service): The twin of CVE-2023-37293: a stack smash in the BMC'sCVE-2023-3043 · AMI MegaRAC SPx 12 / SPx 13 (BMC network service)Critical
• AMI MegaRAC SPx 12 / SPx 13 (BMC network service): Unauthenticated code execution inside the BMC, reachedCVE-2023-37293 · AMI MegaRAC SPx 12 / SPx 13 (BMC network service)Critical