Privilege Escalation in OpenBMC IPMI Implementation

Executive Summary

This vulnerability is a privilege escalation flaw in OpenBMC's IPMI implementation called phosphor-net-ipmid. It allows an authenticated low-privilege user to gain administrative access without reauthentication by exploiting a logic error in session handling. The attacker establishes a session with a low-privilege account, then sends a crafted message to relabel the session with an administrator's credentials while keeping the original encryption keys. This enables privilege escalation via the Set Session Privilege Level command.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring IPMI traffic for unusual session relabeling. Check for multiple RAKP Message 1 packets from the same source targeting different accounts. Use tcpdump or Wireshark to capture IPMI traffic on port 623 and analyze for session privilege escalation attempts.

Useful 0 Not Useful 0

Impact Analysis

If you use systems with OpenBMC's IPMI implementation (such as NVIDIA or H3C devices), an attacker with a low-privilege account could exploit this to gain full administrative control without needing the admin password. This could lead to unauthorized system access, data theft, or system manipulation.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update phosphor-net-ipmid to the latest patched version. Disable IPMI access if not required. Restrict IPMI access to trusted networks only. Monitor for unauthorized privilege escalation attempts in IPMI logs.

Useful 0 Not Useful 0