Linux Kernel IPMI Event Message Buffer Response Validation Vulnerability

A vulnerability in the Linux kernel's IPMI (Intelligent Platform Management Interface) implementation has been addressed. The issue arose because the response data size from the event message buffer was not properly validated immediately after the response was received. Some Baseboard Management Controllers (BMCs) may return an empty message instead of an error when events are fetched. This vulnerability affects several versions of the Linux kernel.

Impact

The vulnerability could lead to improper handling of event messages, potentially causing issues in event processing.

Reproduction

The vulnerability can be reproduced by fetching event data from a BMC that returns an empty message instead of the expected error. This can occur with certain new BMCs that have this flaw.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed.