Database/Firmware, BMC & network fabric
IBM Power Systems firmware: crafted configuration data corrupts host firmware memory during IPL
Impact
Host firmware configuration parsing can be driven into memory corruption during system IPL by configuration data written from the service processor, compromising the host firmware boot stack and the hypervisor it loads afterwards. The window is a boot, which makes it a good match for an attacker who can already force a node to re-IPL, and the result sits beneath every partition on the managed system. This is the higher-impact counterpart of CVE-2026-96261, which IBM scores as a crash with possible corruption; this one is rated as full confidentiality, integrity and availability loss.
Who can reach it
Local to the service processor with authenticated service-level privilege; the attacker writes configuration data via the FSP and the corruption lands on the next IPL.
What to do
Apply the fixed firmware level from IBM support document 7290128; affected levels are FW1060.00 through FW1060.81. Since the bug triggers at IPL, the node has to come down anyway - combine the firmware flash with a scheduled outage and confirm the other FSP advisories from the same batch are covered by the same level. Keep service processor access restricted until then.
References
Related entries
- Supermicro IPMI BMC firmware: Every affected BMC shares one TLS private key and one SSH host key, baked into theCVE-2013-3619 · Supermicro IPMI BMC firmwareHigh
- Dell iDRAC6/iDRAC7 IPMI 1.5 session handling: IPMI 1.5 session IDs are handed out incrementally from a small pool, soCVE-2014-8272 · Dell iDRAC6/iDRAC7 IPMI 1.5 session handlingHigh
- Dell iDRAC9: Stack overflow overwriting iDRAC configuration via oversized payloadsCVE-2021-21540 · Dell iDRAC9High
- GRUB2 (net/ip IPv4 reassembly): Integer underflow in grub_net_recv_ip4_packets from a crafted IP packetCVE-2022-28733 · GRUB2 (net/ip IPv4 reassembly)High
- ATEN PE8108 switched PDU: A restricted (non-admin) user account on the PDU's web interface can control outletsCVE-2023-25409 · ATEN PE8108 switched PDUHigh
- AMI MegaRAC SPx (IPMI handler): Buffer overflow in the BMC's IPMI message handler leading to code executionCVE-2023-34336 · AMI MegaRAC SPx (IPMI handler)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.