Linux kernel ipmi: use-after-free of cmd_rcvr when an IPMI user is destroyed

Impact

A refactor that removed SRCU from the ipmi_interfaces list also dropped the synchronize_rcu() between unlinking command receivers from intf->cmd_rcvrs and freeing them, leaving only the explanatory comment behind. The cmd_rcvrs list is still walked under plain RCU - find_cmd_rcvr() runs inside rcu_read_lock() and handle_ipmb_get_msg_cmd() borrows rcvr->user from that lookup in the same read-side section - so _ipmi_destroy_user() can kfree() a receiver while a reader still holds a pointer to it. On a datacenter server the IPMI stack is always present and talks to the BMC, so this is a host-kernel use-after-free reachable on the path between the OS and out-of-band management: at minimum a node crash, and a use-after-free in kernel context is a privilege-escalation candidate. It needs a local IPMI user to be closing while IPMB traffic is being dispatched.

Who can reach it

Local user able to open /dev/ipmi* (typically root or a management group; ipmitool, ipmi_si consumers, monitoring agents). Requires racing a user close against inbound IPMB message dispatch. No path from the network to this without first having local access to the IPMI device.

What to do

Update the host kernel to a stable release that restores the synchronize_rcu() (three stable commits linked) and reboot the node. As an interim control, restrict /dev/ipmi* to the management agents that genuinely need it, since local access to the device is the precondition. No fixed release number is stated in the record.

References

Related entries

• ASPEED BMC (host-to-BMC bridges generally): The ASPEED LPC/PCIe bridge architecture exists to let the host talkNCVD-0000-001-aspeed-bmc-host-to-bmc-bridges-g · ASPEED BMC (host-to-BMC bridges generally)Unscored
• IPMI over LAN as a protocol: IPMI has no transport confidentiality guarantees worth relying on, weak session handlingNCVD-0000-002-ipmi-over-lan-as-a-protocol · IPMI over LAN as a protocolUnscored
• Internet-exposed BMC: Shodan-visible BMCs are a recurring finding at colo/neocloud buildoutsNCVD-0000-003-internet-exposed-bmc · Internet-exposed BMCUnscored
• InfiniBand subnet manager (OpenSM / UFM): The IB subnet manager has unilateral authority over LID assignment, routingNCVD-0000-004-infiniband-subnet-manager-opensm · InfiniBand subnet manager (OpenSM / UFM)Unscored
• RDMA / RoCE: RoCE and IB RDMA have no cryptographic authentication of the QP connection setup or of subsequentNCVD-0000-005-rdma-roce · RDMA / RoCEUnscored
• NVMe-oF over RDMA: NVMe-over-Fabrics inherits RDMA's lack of authenticationNCVD-0000-006-nvme-of-over-rdma · NVMe-oF over RDMAUnscored