IBM Power Systems firmware: FSP mailbox message reads or modifies arbitrary Hostboot memory

Impact

A crafted mailbox message from the service processor can read or modify arbitrary regions of Hostboot memory, which compromises the host firmware boot stack and, by extension, the PowerVM hypervisor that Hostboot goes on to load. An attacker who can write into Hostboot chooses what the hypervisor is before it exists, so partition isolation and any in-partition hardening are decided by the attacker rather than by the operator. Read access alone exposes secrets handled during early boot. Distinct from the runtime attribute-storage overflows in this batch: the target here is Hostboot memory during the boot stack, not firmware runtime storage.

Who can reach it

Local to the service processor with authenticated service-level privilege. Requires FSP access, not host OS or partition access.

What to do

Apply the fixed firmware level from IBM support document 7290124; affected levels are FW1060.00 through FW1060.81. The defect is in the boot stack, so expect a firmware flash with the managed system down rather than a concurrent update, unless IBM's document says otherwise. Restrict FSP and HMC network reach and review who holds service-level credentials.

References

Related entries

• IBM Power Systems firmware: crafted configuration data corrupts host firmware memory during IPLCVE-2026-96266 · IBM Power Systems host firmware (configuration parsing during IPL)High
• Supermicro IPMI BMC firmware: Every affected BMC shares one TLS private key and one SSH host key, baked into theCVE-2013-3619 · Supermicro IPMI BMC firmwareHigh
• Dell iDRAC6/iDRAC7 IPMI 1.5 session handling: IPMI 1.5 session IDs are handed out incrementally from a small pool, soCVE-2014-8272 · Dell iDRAC6/iDRAC7 IPMI 1.5 session handlingHigh
• Dell iDRAC9: Stack overflow overwriting iDRAC configuration via oversized payloadsCVE-2021-21540 · Dell iDRAC9High
• GRUB2 (net/ip IPv4 reassembly): Integer underflow in grub_net_recv_ip4_packets from a crafted IP packetCVE-2022-28733 · GRUB2 (net/ip IPv4 reassembly)High
• ATEN PE8108 switched PDU: A restricted (non-admin) user account on the PDU's web interface can control outletsCVE-2023-25409 · ATEN PE8108 switched PDUHigh