IBM Power Systems Firmware: crafted code update image passes boot validation and executes on the host

Impact

An attacker who already holds service access to the service processor can feed the host a malicious code update image that the boot-time validation path accepts, ending with arbitrary code running on the host system itself. That is code below every hypervisor and partition on the machine, so it survives OS reinstall and is not visible to anything running above it. IBM rates the scope as changed with full confidentiality, integrity and availability impact on the affected host. On a Power-based accelerator node this converts a management-plane foothold into permanent ownership of the compute node.

Who can reach it

Authenticated service access to the service processor — in practice, someone already on the management network holding service credentials. Not reachable from a tenant workload.

What to do

Affected levels are FW1120.00, FW1110.00 through FW1110.30 and FW1060.00 through FW1060.80; IBM's support document (node 7283221) carries the fix levels — apply them from there rather than guessing a version. Host firmware update means taking the managed system out of service to flash and re-IPL, so this is a scheduled maintenance window per machine, not a rolling change. Until then, treat service-processor credentials and management-network reachability as the control that is holding.

References