Authentication Bypass Vulnerability in OpenBMC Software by OpenBMC
CVE-2021-39296

10CRITICAL

Key Information:

Vendor

Openbmc-project

Status
Openbmc
Vendor
CVE Published:
9 September 2021

What is CVE-2021-39296?

In OpenBMC version 2.9, a vulnerability exists that allows attackers to send specially crafted IPMI messages. This enables bypassing of authentication mechanisms, granting unauthorized access and full control over the system. Such vulnerabilities can lead to significant risk if unaddressed, making it crucial for users to apply security updates promptly.

References

https://github.com/openbmc/openbmc
https://github.com/google/security-research/security/advi...
https://www.intel.com/content/www/us/en/security-center/a...

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.