CVE-2018-9085

🗓️ 16 Nov 2018 14:00:00Reported by lenovoType

A write protection lock bit was left unset after boot on an older generation of Lenovo and IBM System x servers, potentially allowing an attacker with administrator access to modify the subset of flash memory containing Intel Server Platform Services (SPS) and the system Flash Descriptors

Reporter	Title	Published	Views	Family All 8
IBM Security Bulletins	Security Bulletin: Denial of service vulnerability affects IBM Unified Extensible Firmware Interface (CVE-2018-9085)	7 Dec 202322:45	–	ibm
ATTACKERKB	Missing System x Flash Memory Write Protection Lock Bit	16 Nov 201814:29	–	attackerkb
Cvelist	CVE-2018-9085 Missing System x Flash Memory Write Protection Lock Bit	16 Nov 201814:00	–	cvelist
EUVD	EUVD-2018-20688	7 Oct 202500:30	–	euvd
Lenovo	Missing System x Flash Memory Write Protection Lock Bit - Lenovo Support US	14 Nov 201802:28	–	lenovo
Lenovo	Missing System x Flash Memory Write Protection Lock Bit - US	14 Nov 201802:28	–	lenovo
NVD	CVE-2018-9085	16 Nov 201814:29	–	nvd
Prion	Design/Logic Flaw	16 Nov 201814:29	–	prion

NVD

Vulners

Node

lenovo flex_system_x240_m4_firmwareRange<a3e122b

AND

lenovo flex_system_x240_m4Match-

Node

lenovo flex_system_x440_m4_firmwareRange<cge122b

AND

lenovo flex_system_x440_m4Match-

Node

lenovo system_x3750_m4_firmwareRange<a5e124b

AND

lenovo system_x3750_m4Match-

Node

ibm bladecenter_hs23_firmwareRange<tke160c

AND

ibm bladecenterMatchhs23-

Node

ibm bladecenter_hs23e_firmwareRange<ahe160c

AND

ibm bladecenterMatchhs23e-

Node

ibm flex_system_x220_m4_firmwareRange<kse158c

AND

ibm flex_system_x220Match-

Node

ibm flex_system_x222_m4_firmwareRange<cce160c

AND

ibm flex_system_x222_m4Match-

Node

ibm flex_system_x240_m4_firmwareRange<ahe160c

AND

ibm flex_system_x240_m4Match-

Node

ibm flex_system_x280_x6_firmwareRange<n3e132w

AND

ibm flex_system_x280_x6Match-

Node

ibm flex_system_x440_m4_firmwareRange<cne162d

AND

ibm flex_system_x440_m4Match-

Node

ibm flex_system_x480_x6_firmwareRange<n3e132w

AND

ibm flex_system_x480_x6Match-

Node

ibm flex_system_x880_x6_firmwareRange<n2e130e

AND

ibm flex_system_x880_x6Match-

Node

ibm idataplex_dx360_m4_firmwareRange<fhe120d

AND

ibm idataplex_dx360_m4_Match-

Node

ibm idataplex_dx360_m4_water_cooled_firmwareRange<fhe120d

AND

ibm idataplex_dx360_m4_Match-

Node

ibm system_x3100_m4_firmwareRange<jqe184c

AND

ibm system_x3100_m4

Node

ibm system_x3100_m5_firmwareRange<j9e134c

AND

ibm system_x3100_m5

Node

ibm system_x3250_m4_firmwareRange<jqe184c

AND

ibm system_x3250_m4

Node

ibm system_x3250_m5_firmwareRange<jue134c

AND

ibm system_x3250_m5

Node

ibm system_x3300_m4_firmwareRange<yae156c

AND

ibm system_x3300_m4

Node

ibm system_x3500_m4_firmwareRange<y5e158c

AND

ibm system_x3500_m4

Node

ibm system_x3530_m4_firmwareRange<bee164c

AND

ibm system_x3530_m4

Node

ibm system_x3550_m4_firmwareRange<d7e166d

AND

ibm system_x3550_m4

Node

ibm system_x3630_m4_firmwareRange<vve162c

AND

ibm system_x3630_m4

Node

ibm system_x3650_m4_firmwareRange<vve160c

AND

ibm system_x3650_m4

Node

ibm system_x3650_m4_bd_firmwareRange<vve160c

AND

ibm system_x3650_m4_bd

Node

ibm system_x3650_m4_hd_firmwareRange<vve160c

AND

ibm system_x3650_m4_hd

Node

ibm system_x3750_m4_firmwareRange<koe160c

AND

ibm system_x3750_m4

Node

ibm system_x3850_x6_firmwareRange<a8e128c

AND

ibm system_x3850_x6

Node

ibm system_x3950_x6_firmwareRange<bee164c

AND

ibm system_x3950_x6

[
  {
    "product": "System x UEFI",
    "vendor": "Lenovo",
    "versions": [
      {
        "lessThan": "varies",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "System x UEFI",
    "vendor": "IBM",
    "versions": [
      {
        "lessThan": "varies",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
support	www.support.lenovo.com/us/en/solutions/LEN-24477

21 Nov 2024 04:14Current

4.8Medium risk

Vulners AI Score4.8

CVSS 24

CVSS 34.9

EPSS0.00137

CWE-276