IBM Power Systems Firmware: crafted BMC command executes arbitrary code on the host system

Impact

An attacker with service access to the BMC can send a specially crafted command over the BMC-to-host interface and execute arbitrary code on the host, taking full control of the host and all hosted partitions. The affected range here is narrower than the other issues in this batch — FW1120.00 and FW1110.00 through FW1110.30 — so it is largely a current-firmware problem. Operationally it collapses the assumption that the management plane is merely out-of-band: whoever holds the BMC holds the production host and everything running on it.

Who can reach it

An attacker with authenticated service access to the BMC, normally meaning management-VLAN reach plus service credentials. No host account and no user interaction required.

What to do

Update to the fixed FW1120 and FW1110 firmware levels listed by IBM. This is a firmware flash against the affected managed systems; schedule it with the node out of production unless IBM's fix table confirms a concurrent update path for your level. Keep BMC management interfaces off routable networks and rotate service credentials in the meantime.

References