Security Bulletin: This Power System update is being released to address CVE 2022-22309

Summary

POWER8/POWER9: The POWER systems FSP is vulnerable to unauthenticated logins through the physical serial port/TTY interface. This vulnerability can be more critical if the serial port is connected to a serial-over-lan device. In response to this security issue, a new Power System firmware update is being released to address Common Vulnerabilities and Exposures issue number CVE-2022-22309

Vulnerability Details

CVEID:CVE-2022-22309
**DESCRIPTION:**The POWER systems FSP is vulnerable to unauthenticated logins through the serial port/TTY interface. This vulnerability can be more critical if the serial port is connected to a serial-over-lan device.
CVSS Base score: 6.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/217095 for the current score.
CVSS Vector: (CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Firmware release FW860, FW940 and FW950 are affected.

Remediation/Fixes

Customers with the products below, install FW860.B0

1. IBM Power System S812(8284-21A)

2. IBM Power System S822(8284-22A)

3. IBM Power System S814(8286-41A)

4. IBM Power System S824(8286-42A)

5. IBM Power System S812L(8247-21L)

6. IBM Power System S822L(8247-22L)

7. IBM Power System S824L(8247-42L)

8. IBM Power System E850(8408-E8E)

9. IBM Power System E850C(8408-44E)

10. IBM Power System E870(9119-MME)

11. IBM Power System E870C(9080-MME)

12. IBM Power System E880(9119-MHE)

13. IBM Power System E880C(9080-MHE)

14. IBM Power System S812L(5148-21L)

15. IBM Power System S822L(5148-22L)

Customers with the products below, install FW940.60 or FW950.40 or above.

1. IBM Power System S922 (9009-22A)

2. IBM Power System H922 (9223-22H)

3. IBM Power System S914 (9009-41A)

4. IBM Power System S924 (9009-42A)

5. IBM Power System H924 (9223-42H)

6. IBM Power System L922 (9008-22L)

7. IBM Power System E950 (9040-MR9)

Customers with the products below, install FW950.40 or above.

1. IBM Power System S914 (9009-41G)

2. IBM Power System S922 (9009-22G)

3. IBM Power System S924(9009-42G)

4. IBM ESS 5000 Server (5105-22E)

Workarounds and Mitigations

None