ipmi IpmbWrite Validation

Vulnerability analysis

The IPMB driver's write handler reads message fields from a user-supplied buffer before checking that the buffer is long enough to contain a valid IPMB request. A zero-length or overly short write causes the driver to parse uninitialized stack memory as message fields, and a length byte smaller than the SMBus header can underflow a block-write length calculation. The fix adds an explicit check that the write is non-empty and that the supplied length byte plus payload meet the minimum IPMB request size before any field parsing begins. The vulnerable path is reachable locally by any user who can open and write to the IPMB character device, which typically requires the IPMB driver module to be loaded and the corresponding device node to be present.