Gadi Evron

A logic flaw in the IPMI implementation of OpenBMC allows the authorization context of an active session to be replaced with a target account. This occurs while the original integrity and encryption keys remain active, enabling privilege escalation without the need for re-authentication. This implementation is used by several downstream vendors, including NVIDIA and H3C.

A logic flaw in the IPMI implementation allows an unauthenticated client to force the RAKP Message 1 handler to return before the authentication object's constructor defaults are overwritten. Consequently, the IPMI service accepts a RAKP Message 3 where the HMAC is calculated using a predictable `bmcRandomNum` and a constant 20-byte `userKey` initialized as '0penBmc'. This issue affects OpenBMC and downstream vendors using phosphor-net-ipmid as their IPMI stack, including NVIDIA and H3C.

The issue concerns an undocumented administrative account with a default password. This allows local users to gain privileges via the expert command.