CyberRota Analysis
AI-GeneratedThe IPMI implementation in OpenBMC's phosphor-net-ipmid is vulnerable due to a logic flaw that allows unauthenticated clients to manipulate the authentication process, potentially leading to unauthorized access. This vulnerability can be exploited to bypass authentication mechanisms, compromising the integrity of the system. Organizations using affected IPMI stacks, particularly those from downstream vendors like NVIDIA and H3C, should prioritize remediation efforts to mitigate the risk of exploitation.
Original NVD Description
OpenBMC's IPMI implementation, phosphor-net-ipmid, contains a logic flaw in which an unauthenticated client can force the RAKP Message 1 handler to return before it overwrites the authentication object's constructor defaults. The IPMI service then accepts a RAKP Message 3 whose HMAC is computed with the constant 20-byte 'userKey' initialized from the string '0penBmc' and an often-predictable 'bmcRandomNum'. Several downstream vendors implement phosphor-net-ipmid as their IPMI stack, such as NVIDIA and H3C.