IBM PowerVM partition firmware: unauthenticated attacker on the boot VLAN can substitute a netboot image

Impact

An unauthenticated attacker on the same network as a partition that is performing a network boot can stop that partition from completing its boot sequence, and — where OS secure boot is off, which IBM states is the default — substitute the boot image outright, compromising everything the partition loads afterwards. IBM is explicit that other partitions and the managed system are not affected and that only partitions actively netbooting are exposed, which narrows this to provisioning windows. For a fleet that reprovisions nodes from the network, that window is exactly when a node is unattended and trusted, so a substituted image lands a persistent implant into a freshly built node.

Who can reach it

Anyone with adjacent-network access to the provisioning/boot VLAN, unauthenticated. Only exploitable while a partition is actively performing a network boot.

What to do

Affected levels are FW1120.00, FW1110.00–FW1110.30, FW1060.00–FW1060.80 and FW950.00–FW950.H2; IBM's support document (node 7283234) lists the fix levels, applied as a system firmware update with the machine out of service. Two things help before that: enable OS secure boot on partitions so a substituted image will not load, and keep the netboot path on an isolated provisioning network rather than a shared VLAN.

References