IBM Power FSP: malformed ASMI request gives unauthenticated code execution on the service processor

Impact

An unauthenticated request to the ASMI web interface of the Flexible Service Processor lets an attacker run arbitrary code on the service processor, which IBM describes as full control over the managed system. The FSP sits below the operating system in the same position a BMC does: it owns power control, platform configuration and console access, so code there survives an OS reinstall and is not visible to anything running in a partition. On an accelerated Power host the practical result is that a foothold on the management network converts into ownership of every partition on the box, including the ones holding accelerator workloads. Affected levels are FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2.

Who can reach it

Adjacent network - anyone who can reach the FSP's ASMI interface, which is the management VLAN. No authentication and no prior account on the system.

What to do

Apply the fixed Power Systems firmware level from IBM's advisory (support node 7283893); the record does not state the fixed level numbers, so read them off the advisory for your machine type. Platform firmware activation on Power is a service-processor update and should be scheduled as a disruptive window unless IBM marks your specific service pack concurrent. Until the flash, the only real mitigation is confining ASMI reachability to a segmented management network with no tenant or general-purpose routes into it.

References