What happened
In the Linux kernel, the following vulnerability has been resolved: ipmi: ipmb: validate write message length ipmb_write() read message fields before validating the length byte. A zero or short write can read uninitialized stack bytes. A length smaller than the SMBus header underflows the block write length. Require a non-empty buffer and the minimum IPMB request length. Also require the length byte plus payload before parsing the message.
Affected versions
Linux: 51bd6f291583684f495ea498984dfc22049d7fd2 through before 60939bcda6f3f104ef456fdbf3cc5733c0720fb1 (git); 51bd6f291583684f495ea498984dfc22049d7fd2 through before 5719431ca2b5fa26560bb38f6202f8b97fa3bbb0 (git); 51bd6f291583684f495ea498984dfc22049d7fd2 through before a84c6e3d188f2c6e674910929eb790634299d6d5 (git); 51bd6f291583684f495ea498984dfc22049d7fd2 through before 53637506884dbd5c91a89b1a3547d99d80f8ed2c (git); 5.3 Fixed: See vendor advisory.
Why it matters
Review the vendor advisory and exposure of the affected product to determine operational impact.
Detection & mitigation
- Apply vendor-provided updates or mitigations.
- Review affected product exposure and access logs.
Public PoC references
No public PoC reference has passed the current publication threshold.