IBM Power Systems firmware: crafted service-processor configuration data crashes the host firmware boot stack

Impact

A service-level account on the flexible service processor can write configuration data that makes the host firmware boot stack crash, with possible memory corruption, during system initialisation. On a Power node carrying accelerators this is an availability event at the firmware layer: the managed system fails or mis-completes IPL and cannot be brought back by restarting software, so whatever was running on the node is gone until someone works the box back to a clean boot. IBM rates integrity impact as low and availability as high, with scope change to the managed system. This is the lower-severity sibling of the configuration-parsing memory-corruption issue tracked separately as CVE-2026-96266.

Who can reach it

Local to the service processor: an attacker needs authenticated low-privilege service-level access to the FSP (management network reachability plus service credentials). No access to the host OS or to tenant workloads is required.

What to do

Apply the fixed IBM Power Systems firmware level named in IBM support document 7290127; affected levels are FW1060.00 through FW1060.81. The advisory text given here does not state whether the update is concurrent, and the defect sits in the boot-stage path, so plan for the managed system to be down during the update. Until then, restrict FSP/HMC network reach to the management VLAN and audit service-level accounts.

References

Related entries

• AMD SEV / SEV-ES - missing nested page table protection: SEV and SEV-ES do not protect the nested page tables, so aCVE-2020-12967 · AMD SEV / SEV-ES - missing nested page table protectionHigh
• ArubaOS GRUB2 implementation (secure boot): Two flaws in ArubaOS's GRUB2 implementation allow secure bootCVE-2020-24637 · ArubaOS GRUB2 implementation (secure boot)High
• Inspur NF5266M5 through firmware 3.21.2 and other Inspur M5-generation servers: An attacker with administrative reachCVE-2020-26122 · Inspur NF5266M5 through firmware 3.21.2 and other Inspur M5-generation serversHigh
• AMD SEV / SEV-ES - guest address space rearrangement undetected by attestation: A malicious hypervisor can rearrangeCVE-2021-26311 · AMD SEV / SEV-ES - guest address space rearrangement undetected by attestationHigh
• Intel TXT SINIT Authenticated Code Module for some Intel processors: Improper initialization in the SINIT ACMCVE-2022-30704 · Intel TXT SINIT Authenticated Code Module for some Intel processorsHigh
• Intel Xeon memory controller configuration (with SGX): Memory controller configuration registers are left withCVE-2022-33196 · Intel Xeon memory controller configuration (with SGX)High