Local Process Termination Vulnerability in IPMI Event Daemon of ipmitool
Summary
CVE-2011-4339: ipmievd (aka the IPMI event daemon) in OpenIPMI, as used in the ipmitool package 1.8.11 in Red Hat Enterprise Linux (RHEL) 6, Debian GNU/Linux, Fedora 16, and other products uses 0666 permissions for its ipmievd.pid PID... Affects ipmitool versions < 1.8.11-5. Fixed in 1.8.11-5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ipmitool package, which includes the IPMI event daemon (ipmievd), is widely used for managing and monitoring hardware through the Intelligent Platform Management Interface (IPMI). It allows users to perform various management tasks, such as power cycling and sensor monitoring, across different operating systems including Red Hat Enterprise Linux and Debian. However, a significant security flaw exists in the way the ipmievd.pid file is handled, leading to potential local privilege escalation.
Vulnerability Detail
The vulnerability, identified as CVE-2011-4339, arises from the ipmievd PID file being assigned overly permissive permissions (0666). This configuration allows any local user to write to the PID file, which can lead to the termination of arbitrary processes. The flaw is particularly concerning as it can be exploited by unprivileged users to disrupt services or gain unauthorized control over system processes, posing a serious risk to system integrity and availability.
How To Fix
Minimum fixed version
1.8.11-5
This is the first release that contains the fix.
sudo apt-get install --only-upgrade ipmitoolTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, system administrators can change the permissions of the ipmievd.pid file to restrict access. This can be done by executing the following command: chmod 0644 /var/run/ipmievd.pid. However, this is not a permanent fix and should be followed up with an upgrade of the ipmitool package.
Conclusion
CVE-2011-4339 represents a significant security vulnerability in the ipmitool package, specifically affecting the IPMI event daemon. By understanding the nature of this vulnerability and taking appropriate action, such as upgrading the package or applying temporary workarounds, users can protect their systems from potential exploitation.
See every vulnerability recorded for ipmitool →
FAQ
CVE-2011-4339 is a vulnerability in the IPMI event daemon of the ipmitool package that allows local users to terminate arbitrary processes due to improper permissions on the PID file.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring installation.
The main risk is that unprivileged local users can disrupt critical system processes, potentially leading to denial of service or unauthorized access to system resources.
Yes, a patch is available in the form of an updated ipmitool package. Users should upgrade to version 1.8.11-5 or later to mitigate the vulnerability.
If an immediate upgrade is not possible, you should implement the workaround by changing the permissions of the ipmievd.pid file to limit access until a proper update can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for ipmitool.
