The Linux kernel IPMI IPMB driver had a vulnerability in the ipmb_write() function where message fields were read before validating the length byte. This flaw could cause reading of uninitialized stack memory when the write length was zero or shorter than expected. Furthermore, if the length was smaller than the SMBus header, it could cause an underflow in the block write length calculation. The vulnerability was addressed by enforcing a non-empty buffer, a minimum IPMB request length, and validating the length byte plus payload before message parsing.

The vulnerability could lead to reading uninitialized stack memory, which may expose sensitive data or cause undefined behavior in the kernel. There is no information about active exploitation in the wild or further impact such as privilege escalation or denial of service.

A fix has been applied to the Linux kernel to validate the write message length in ipmb_write(). Users should update to a kernel version that includes this fix. Since this is a kernel vulnerability, applying the official kernel update from the vendor or distribution is the recommended remediation.