CVE-2024-42934

What it actually does

Out-of-bounds array access in the ipmi_sim simulator when handling authentication types, resulting in denial of service or, with very low probability, authentication bypass or code execution.

Why it matters to the business

Potential disruption to environments relying on IPMI simulation services, with minimal risk of broader system compromise due to the low-probability outcomes and attack complexity.

How an attack unfolds

An attacker identifies an accessible ipmi_sim instance and transmits a crafted network packet containing an invalid authentication type value, triggering the memory corruption flaw.

How to fix it

Upgrade OpenIPMI to version 2.0.36 or later.

How to confirm the fix worked

Confirm OpenIPMI version is at least 2.0.36; perform functional testing of the ipmi_sim simulator with varied authentication type inputs to verify stability.

Typical attack path

1. Locate exposed ipmi_sim simulator instances on the network
2. Craft a packet with an out-of-range authentication type
3. Transmit the packet to trigger the out-of-bounds access
4. Observe service crash or attempt to leverage low-probability code execution

How to detect it

Inspect application logs for ipmi_sim crashes or errors related to authentication type processing; examine network captures for anomalous IPMI traffic with invalid authentication values.

What your security team should do

• Apply the 2.0.36 update to OpenIPMI promptly
• Disable or restrict access to ipmi_sim if the simulator functionality is not required
• Review network segmentation around IPMI-related services