IBM Power Systems host firmware: crafted service-processor command leaks protected registers

Impact

A crafted command from the service processor causes host firmware to return the contents of hardware registers that the service processor is not supposed to be able to read, and can also impact host availability. The trust boundary that is supposed to keep the out-of-band controller from reading host hardware state is what breaks here, which matters on any machine where the management plane and the tenant workload have different owners. IBM characterises the confidentiality impact as limited but the availability impact on the host as high, and CVSS marks a scope change onto the host system. What exactly the leaked registers contain is not described in the record, so treat the confidentiality side as unquantified.

Who can reach it

Local access on the service processor with high privilege (service-level access to the SP). Not reachable from a tenant workload on the host.

What to do

Update host firmware to the level given in IBM advisory node 7283222; affected levels are FW1120.00, FW1110.00-FW1110.30 and FW1060.00-FW1060.80, and the record does not name the fixed level. This is a host firmware flash and requires the node out of service. Until then, treat service-processor access as equivalent to host access when deciding who gets it.

References