PT-2021-7645 · Openbmc · Openbmc

Ya-Mouse · Published 2021-09-02 · Updated 2023-02-16 · CVE-2021-39296

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenBMC version 2.9

Description The issue is related to the netipmid interface (IPMI lan+) in the OpenBMC embedded operating system, which is associated with errors during the authentication procedure. An attacker can exploit this issue by sending crafted IPMI messages, allowing them to bypass authentication and gain full control of the system.

Recommendations For OpenBMC version 2.9, as a temporary workaround, consider restricting access to the netipmid interface until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2023-00780

CVE-2021-39296

GHSA-GG9X-V835-M48Q

Affected Products

Openbmc

References · 8

• 🔥 https://github.com/google/security-research/security/advisories/GHSA-gg9x-v835-m48q · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-39296 · Security Note
• https://osv.dev/vulnerability/CVE-2021-39296 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00780 · Security Note
• https://github.com/openbmc/openbmc · Note
• https://t.me/cvenotify/21284 · Telegram Post
• https://t.me/true_secator/4077 · Telegram Post
• https://intel.com/content/www/us/en/security-center/advisory/intel-sa-00737.html · Note