Impact
Any OpenBMC system that includes the slpd-lite package is impacted. Installing this package is the default when building OpenBMC. Nefarious users can send slp packets to the BMC using UDP port 427 to cause memory overflow issues within the slpd-lite daemon on the BMC.
Patches
Patches are available in the openbmc/slpd-lite repository. The fix is a series of 7 commits ending in 20bab74.
Workarounds
Block UDP port 427 on your network to prevent users from accessing the BMC. If ssh access to the BMC is available, the slpd-lite.service can be disabled via systemctl.
References
N/A
Impact
Any OpenBMC system that includes the slpd-lite package is impacted. Installing this package is the default when building OpenBMC. Nefarious users can send slp packets to the BMC using UDP port 427 to cause memory overflow issues within the slpd-lite daemon on the BMC.
Patches
Patches are available in the openbmc/slpd-lite repository. The fix is a series of 7 commits ending in 20bab74.
Workarounds
Block UDP port 427 on your network to prevent users from accessing the BMC. If ssh access to the BMC is available, the slpd-lite.service can be disabled via systemctl.
References
N/A