Security Bulletin
Summary
PowerVM partition firmware is the portion that executes in each partition during boot. On POWER9 systems an attacker that gains service access to the FSP can compromise partition firmware for any partition configured on the system. On all affected systems an attacker that gains admin authority to a partition can compromise partition firmware for that partition.
Vulnerability Details
CVEID: CVE-2022-22445
DESCRIPTION: An attacker that gains service access to the FSP (POWER9 only) or gains admin authority to a partition can compromise partition firmware.
CVSS Base score: 7.6
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/224546 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L)
Affected Products and Versions
Affected Product(s) | Version(s) |
PowerVM Hypervisor | FW1010 and later |
PowerVM Hypervisor | FW950 and later |
Remediation/Fixes
Customers with the products below should install FW950.40(Vx950_099), FW1010.32(MH1010_135) or newer to remediate this concern.
Power 9
1) IBM Power System S922 (9009-22A, 9009-22G)
2) IBM Power System H922 (9223-22H, 9223-22S)
3) IBM Power System S914 (9009-41A, 9009-41G)
4) IBM Power System S924 (9009-42A, 9009-42G)
5) IBM Power System H924 (9223-42H, 9223-42S)
6) IBM Power System E950 (9040-MR9)
7) IBM Power System E980 (9080-M98, 9080-M9S)
Power 10
1) IBM Power System E1080 (9080-HEX)
Workarounds and Mitigations
None
Get Notified about Future Security Bulletins
References
Change History
07 Jul 2022: Initial Publication
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Document Location
Worldwide
Was this topic helpful?
Document Information
Modified date:
15 July 2022
UID
ibm16604071