IBM Power Systems firmware: guest-partition root can write NVRAM that crashes the host firmware boot stage

Impact

An attacker with root inside a guest partition on an OpenPOWER system can write a crafted NVRAM image that makes the host firmware boot stage crash, with possible memory corruption. The damage outlives the attacker's partition: the machine stays in that state until an operator clears NVRAM through the service processor, so the node does not recover on its own reboot. For an accelerated OpenPOWER node this is a guest-to-host denial of service that costs an out-of-band recovery trip rather than a reboot cycle, and it takes every other partition on the machine down with it. Only OpenPOWER systems are affected; PowerVM systems are not.

Who can reach it

Local — root within a guest partition on an OpenPOWER host running the affected firmware levels (FW950.00 through FW950.H2, OP940.00 through OP940.a1 on Power9, OP940.00 through OP940.81 on the Power HMC). No management-network or physical access is needed.

What to do

Apply the IBM firmware update named in the advisory for your FW950 or OP940 level. That is a firmware flash and needs the system out of service for the update window. A machine already in the crashed state must have its NVRAM cleared from the service processor before it will boot again.

References