Buffer Overflow in openUBMC PLDM and NCSI Parsers

Executive Summary

The vulnerability involves the openUBMC device-management process parsing PLDM-over-MCTP and NCSI-over-MCTP responses. Three response parsers subtract a fixed header size from a device-supplied response length without checking if the result is negative. This can cause an undersized response to wrap to a very large value, leading to buffer overflow as the parser reads beyond the intended data.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring for abnormal behavior in PLDM or NCSI response handling on the internal management bus. Check for devices sending undersized responses or triggering heap read errors in openUBMC logs. Use network monitoring tools to inspect MCTP traffic for malformed PLDM/NCSI packets. No specific commands are provided in the available resources.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability may allow an attacker on the internal management bus to cause a denial of service or potentially execute arbitrary code on the affected system by sending maliciously crafted responses to the openUBMC device-management process.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability may impact compliance with standards like GDPR or HIPAA by potentially exposing sensitive BMC heap contents through out-of-bounds reads, which could lead to unauthorized data disclosure. However, no confirmed arbitrary memory-write or code-execution capabilities exist, limiting the immediate impact on compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Update the openUBMC device-management process and shared transport libraries to include lower-bound checks for response lengths. Ensure all PLDM and NCSI parsers validate device-supplied response sizes before processing.

Useful 0 Not Useful 0