Bug 26218 - ipmitool new security issue CVE-2020-5208
Summary: ipmitool new security issue CVE-2020-5208
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 7
Hardware: All Linux
Priority: Normal major
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA7-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2020-02-19 23:15 CET by David Walser
Modified: 2020-02-24 22:46 CET (History)
6 users (show)

See Also:
Source RPM: ipmitool-1.8.18-4.mga8.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2020-02-19 23:15:58 CET
Debian-LTS has issued an advisory on February 9:
https://www.debian.org/lts/security/2020/dla-2098

The issue is fixed upstream in 1.8.19.

Mageia 7 is also affected.
David Walser 2020-02-19 23:16:09 CET

Whiteboard: (none) => MGA7TOO

Comment 1 David GEIGER 2020-02-20 09:46:14 CET
Done for both Cauldron and mga7!

CC: (none) => geiger.david68210

Comment 2 David Walser 2020-02-20 13:07:25 CET
Advisory:
========================

Updated ipmitool package fix security vulnerability:

Christopher Ertl found that multiple functions in ipmitool neglect proper
checking of the data received from a remote LAN party, which may lead to buffer
overflows and potentially to remote code execution on the ipmitool side
(CVE-2020-5208).

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5208
https://www.debian.org/lts/security/2020/dla-2098
========================

Updated packages in core/updates_testing:
========================
ipmitool-1.8.18-3.1.mga7

from ipmitool-1.8.18-3.1.mga7.src.rpm

Whiteboard: MGA7TOO => (none)
Assignee: bugsquad => qa-bugs
Version: Cauldron => 7

Comment 3 Len Lawrence 2020-02-21 00:03:38 CET
Mageia7, x86_64

Tried ipmitool before the update and could not get the ipmi service to start; it complains about some script error.  openipmi is already installed.

Updated ipmitool.
Used cheatsheet at https://www.tzulo.com/crm/knowledgebase/47/IPMI-and-IPMITOOL-Cheat-sheet.html

$ su -

# chkconfig ipmi on
There is an ipmi executable script in /etc/init.d which has options such as start and restart.  Decided to stay with systemd.
# systemctl start ipmi
Job for ipmi.service failed because the control process exited with error code.
See "systemctl status ipmi.service" and "journalctl -xe" for details.

Neither of those logs are specific enough to diagnose the cause.
# journalctl -xe | tail
-- The unit ipmi.service has entered the 'failed' state with result 'exit-code'.
Feb 20 22:51:57 difda systemd[1]: Failed to start LSB: OpenIPMI Driver init script.
-- Subject: A start job for unit ipmi.service has failed
-- Defined-By: systemd
-- 
-- A start job for unit ipmi.service has finished with a failure.

Any attempt to use ipmitool results in failure; e.g.
$ ipmitool mc info
Could not open device at /dev/ipmi0 or /dev/ipmi/0 or /dev/ipmidev/0: No such file or directory
# ipmitool user list 1
Could not open device at /dev/ipmi0 or /dev/ipmi/0 or /dev/ipmidev/0: No such file or directory

So, what is missing?

CC: (none) => tarazed25

Len Lawrence 2020-02-21 00:04:05 CET

Keywords: (none) => feedback

Comment 4 David Walser 2020-02-21 00:20:40 CET
Probably your computer doesn't support ipmi.

Keywords: feedback => (none)

Comment 5 Len Lawrence 2020-02-21 00:32:14 CET
Looked for information on configuring openimi and found an Oracle site:
https://docs.oracle.com/en/database/oracle/oracle-database/19/cwlin/configuring-the-open-ipmi-driver.html#GUID-BD943D46-0AAA-44E2-AD07-0651526DB13B

# lsmod | grep ipmi
ipmi_msghandler        61440  1 nvidia
# modprobe ipmi_si
modprobe: ERROR: could not insert 'ipmi_si': No such device
# modprobe ipmi_devintf
# lsmod | grep ipmi
ipmi_msghandler        61440  1 nvidia

# cd /etc
# vi rc.local
# cat rc.local
# START IPMI ON SYSTEM RESTART 
/sbin/modprobe ipmi_msghandler 
/sbin/modprobe ipmi_si 
/sbin/modprobe ipmi_devintf

Restarted system.
# journalctl -xe | grep ipmi
# systemctl status ipmi.service
....
Feb 20 23:23:41 difda systemd[1]: Failed to start LSB: OpenIPMI Driver init script
# modprobe ipmi_si
modprobe: ERROR: could not insert 'ipmi_si': No such device
# modprobe ipmi_devintf
# lsmod | grep ipmi
ipmi_devintf           20480  0
ipmi_msghandler        61440  2 ipmi_devintf,nvidia

$ ipmitool mc info
Could not open device at /dev/ipmi0 or /dev/ipmi/0 or /dev/ipmidev/0: No such file or directory
Comment 6 Len Lawrence 2020-02-21 00:50:06 CET
Reading further, it looks as if the IPMI system is specific to motherboards which have a built-in BMC.  How to check for such a thing?  It should also have its own nic but my test machine has only one ethernet socket.  So does it require a special server machine to work?
Comment 7 David Walser 2020-02-21 01:00:40 CET
Generally speaking, I believe so.
Comment 8 Len Lawrence 2020-02-21 01:15:50 CET
Thanks David - I missed your earlier remark.
Comment 9 Herman Viaene 2020-02-21 16:10:08 CET
@ Len
I don't any further than you did. Tried the openipmigui (needed to install additionaly tkinter and tix packages manually to get it running, but it tries to connect to something which apparently it does not find. Not inmy league.

CC: (none) => herman.viaene

Comment 10 Len Lawrence 2020-02-21 20:07:04 CET
@Herman:
Yes David is correct - special hardware is required for this.  It is something extra on the motherboard as far as I can understand.  All we can do is say that the update installed without problems.  The ipmitool commands respond even though they come back with an error (as expected).  Summing our experience, this can be passed.

Whiteboard: (none) => MGA7-64-OK

Comment 11 Thomas Andrews 2020-02-22 15:16:30 CET
Lacking any knowledge in this area whatsoever, Len's and Herman's conclusions read as about right to me. Validating. Advisory in Comment 2.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Comment 12 claire robinson 2020-02-22 18:57:11 CET
Tests OK mga7 64

Just checked it at least tries to connect to a random device on the LAN. I didn't expect it to connect to anything but at least try to, which it seemed to do.

$ ipmitool -I lan -H 192.168.10.1 -vv -A NONE raw
Sending IPMI/RMCP presence ping packet
ipmi_lan_send_cmd:opened=[1], open=[4606832]
  No response from remote controller
Get Auth Capabilities command failed
Error: Unable to establish LAN session
Error: Unable to establish IPMI v1.5 / RMCP session
Thomas Backlund 2020-02-24 21:51:57 CET

CC: (none) => tmb
Keywords: (none) => advisory

Comment 13 Mageia Robot 2020-02-24 22:46:00 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2020-0097.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.