PowerVM partition firmware is the portion that executes in each partition during boot. On POWER9 systems an attacker that gains service access to the FSP can compromise partition firmware for any partition configured on the system. On all affected systems an attacker that gains admin authority to a partition can compromise partition firmware for that partition.
DESCRIPTION: An attacker that gains service access to the FSP (POWER9 only) or gains admin authority to a partition can compromise partition firmware.
CVSS Base score: 7.6
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/224546 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L)
Affected Products and Versions
|PowerVM Hypervisor||FW1010 and later|
|PowerVM Hypervisor||FW950 and later|
Customers with the products below should install FW950.40(Vx950_099), FW1010.32(MH1010_135) or newer to remediate this concern.
1) IBM Power System S922 (9009-22A, 9009-22G)
2) IBM Power System H922 (9223-22H, 9223-22S)
3) IBM Power System S914 (9009-41A, 9009-41G)
4) IBM Power System S924 (9009-42A, 9009-42G)
5) IBM Power System H924 (9223-42H, 9223-42S)
6) IBM Power System E950 (9040-MR9)
7) IBM Power System E980 (9080-M98, 9080-M9S)
1) IBM Power System E1080 (9080-HEX)
Workarounds and Mitigations
Get Notified about Future Security Bulletins
07 Jul 2022: Initial Publication
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Was this topic helpful?
15 July 2022