IBM Power Systems Firmware: crafted configuration data from the BMC/FSP compromises the host boot stage

Impact

Host firmware mishandles configuration data supplied through the service processor, so an attacker with service-level BMC/FSP access can compromise the host firmware boot stage and, with it, everything loaded afterwards — hypervisor, partitions and workloads. Because the compromise lands at boot, it survives reinstalling partitions and is not something a host-side agent can detect. Affected levels reach back through FW950 and the OP940 Power9 and Power HMC streams. Recovery for a system you believe was hit is a firmware rebuild, not a redeploy.

Who can reach it

An attacker with authenticated service-level access to the BMC/FSP. That means management-network reach and valid service credentials; no interaction from a host user is needed.

What to do

Apply the fixed IBM firmware for the affected FW1120, FW1110, FW1060, FW950 and OP940 levels per the advisory, as a firmware flash on the managed system (and on the HMC for the OP940 Power HMC stream). Because the flaw is in the boot path, a system suspected of prior compromise should be re-flashed rather than only updated. No mitigation short of updating is stated in the record.

References