Security Bulletin: Multiple Vulnerabilities in Lenovo XCC affect IBM Cloud Pak System

Vulnerability Details

CVEID:   CVE-2023-20599
DESCRIPTION:   Improper register access control in ASP may allow a privileged attacker to perform unauthorized access to ASP’s Crypto Co-Processor (CCP) registers from x86 resulting in potential loss of control of cryptographic key pointer/index leading to loss of integrity or confidentiality.
CWE:   CWE-1262: Improper Access Control for Register Interface
CVSS Source:   psirt@amd.com
CVSS Base score:   7.9
CVSS Vector:   (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N)

CVEID:   CVE-2024-13176
DESCRIPTION:   Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation. Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attacker. However, measuring the timing would require either local access to the signing application or a very fast network connection with low latency. There is a timing signal of around 300 nanoseconds when the top word of the inverted ECDSA nonce value is zero. This can happen with significant probability only for some of the supported elliptic curves. In particular the NIST P-521 curve is affected. To be able to measure this leak, the attacker process must either be located in the same physical computer or must have a very fast network connection with low latency. For that reason the severity of this vulnerability is Low. The FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue.
CWE:   CWE-385: Covert Timing Channel
CVSS Source:   CISA ADP
CVSS Base score:   4.1
CVSS Vector:   (CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)

CVEID:   CVE-2024-38796
DESCRIPTION:   EDK2 contains a vulnerability in the PeCoffLoaderRelocateImage(). An Attacker may cause memory corruption due to an overflow via an adjacent network. A successful exploit of this vulnerability may lead to a loss of Confidentiality, Integrity, and/or Availability.
CWE:   CWE-122: Heap-based Buffer Overflow
CVSS Source:   CVE.org
CVSS Base score:   5.9
CVSS Vector:   (CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L)

CVEID:   CVE-2024-53010
DESCRIPTION:   Memory corruption may occur while attaching VM when the HLOS retains access to VM.
CWE:   CWE-284: Improper Access Control
CVSS Source:   product-security@qualcomm.com
CVSS Base score:   7.8
CVSS Vector:   (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

CVEID:   CVE-2024-55567
DESCRIPTION:   Improper input validation was discovered in UsbCoreDxe in Insyde InsydeH2O kernel 5.4 before 05.47.01, 5.5 before 05.55.01, 5.6 before 05.62.01, and 5.7 before 05.71.01. The SMM module has an SMM call out vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level.
CWE:   CWE-20: Improper Input Validation
CVSS Source:   NVD
CVSS Base score:   6.7
CVSS Vector:   (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

CVEID:   CVE-2025-4275
DESCRIPTION:   A vulnerability in the digital signature verification process does not properly validate variable attributes which allows an attacker to bypass signature verification by creating a non-authenticated NVRAM variable. An attacker may to execute arbitrary signed UEFI code and bypass Secure Boot.
CVSS Source:   Insyde
CVSS Base score:   7.8
CVSS Vector:   (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)