CVE-2026-33554: 
Rocky Linux vulnerability analysis and mitigation

CVE-2026-33554 is a buffer overflow vulnerability in the ipmi-oem command of FreeIPMI before version 1.6.17, affecting three specific OEM subcommands used to communicate with IPMI servers on Dell, Supermicro, and Wistron hardware. The vulnerability was disclosed on March 24, 2026, and affects FreeIPMI versions prior to 1.6.17 (including the Azure Linux 3 package freeipmi_1.6.11-1). It carries a CVSS v3.1 base score of 7.5 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is improper buffer handling (CWE-120: Classic Buffer Overflow; CWE-121: Stack-based Buffer Overflow) when parsing response messages returned by IPMI servers. Three ipmi-oem subcommands are affected: dell get-last-post-code (retrieves last POST code/error string on Dell servers), supermicro extra-firmware-info (retrieves firmware info on Supermicro servers), and wistron read-proprietary-string (reads a proprietary string on Wistron servers). An attacker controlling or impersonating an IPMI server can craft a malicious response message that overflows a stack buffer in the client, potentially enabling code execution or denial of service. No authentication is required on the network side to trigger the overflow, as the vulnerability is in the client's response parsing logic (Red Hat Bugzilla, oss-security).

Successful exploitation could allow a malicious IPMI server (or a network attacker performing a man-in-the-middle attack) to cause remote code execution or denial of service on systems running vulnerable FreeIPMI clients. The impact is primarily on availability (crash/DoS), with potential for code execution depending on stack layout and mitigations in place. Organizations using Dell, Supermicro, or Wistron servers that rely on ipmi-oem for platform management are most at risk, particularly if IPMI management networks are not properly isolated (Red Hat Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation as of the time of this report. The EPSS score is approximately 0.042%, indicating low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires network access to an IPMI management interface and the ability to control or spoof IPMI server responses (Red Hat Advisory).

1. Reconnaissance: Identify systems running FreeIPMI before version 1.6.17 that use the ipmi-oem command against Dell, Supermicro, or Wistron hardware. Scan for exposed IPMI management interfaces (UDP/623, TCP/623) on the target network.
2. Position for attack: Gain a network position capable of intercepting or spoofing IPMI responses — either by compromising the IPMI server, performing ARP spoofing on the management network, or setting up a rogue IPMI server.
3. Trigger vulnerable subcommand: Wait for or induce the target system to execute one of the vulnerable ipmi-oem subcommands: ipmi-oem dell get-last-post-code, ipmi-oem supermicro extra-firmware-info, or ipmi-oem wistron read-proprietary-string.
4. Craft malicious response: Return an oversized or malformed IPMI OEM response message that overflows the stack buffer in the FreeIPMI client during response parsing.
5. Achieve impact: Depending on stack layout and system mitigations (ASLR, stack canaries), the overflow may crash the ipmi-oem process (DoS) or, in a worst case, allow control of the instruction pointer for arbitrary code execution in the context of the user running ipmi-oem (Red Hat Bugzilla).

• Network: Unexpected or anomalous IPMI traffic (UDP/TCP port 623) originating from unauthorized hosts on the management network; IPMI response packets with unusually large payload sizes targeting ipmi-oem sessions.
• Logs: System logs showing crashes or segmentation faults in the ipmi-oem process; core dump files generated by ipmi-oem in /var/crash or the working directory.
• Process: Unexpected termination of ipmi-oem with signal 11 (SIGSEGV) or signal 6 (SIGABRT); unusual child processes spawned from ipmi-oem if exploitation leads to code execution.

Upgrade FreeIPMI to version 1.6.17 or later to remediate CVE-2026-33554. Red Hat has issued patches for RHEL 8 (RHSA-2026:20579), RHEL 9 (RHSA-2026:14819, RHSA-2026:19208), and RHEL 10 (RHSA-2026:13515, RHSA-2026:19053). SUSE has issued SUSE-SU-2026:1754-1 for affected SUSE Linux Enterprise products, and openSUSE Tumbleweed has also received updates. As a workaround, restrict network access to IPMI management interfaces to trusted administrative networks only, and avoid running ipmi-oem against untrusted or potentially compromised IPMI servers. Note that FreeIPMI 1.6.18 was subsequently released to fix additional buffer overflows in other ipmi-oem subcommands (not covered by this CVE) (Red Hat Bugzilla, SUSE Advisory, oss-security).

The oss-security mailing list noted that CVE-2026-33554 covered a specific set of subcommands fixed in FreeIPMI 1.6.17, and that the subsequent 1.6.18 release addressed additional buffer overflows in other ipmi-oem subcommands not covered by this CVE, suggesting ongoing security review of the codebase (oss-security). Multiple Linux distributions including Red Hat, SUSE, openSUSE, AlmaLinux, Rocky Linux, and Oracle Linux issued security advisories and updated packages in a timely manner following disclosure. Coverage was noted on pro-linux.de and linuxcompatible.org, reflecting standard community awareness for a library-level vulnerability.