Security Bulletin: This Power System update is being released to address CVE-2018-5391

Summary

POWER9: In response to a denial of service vulnerability, a new Power Systems firmware update is being released to address Common Vulnerabilities and Exposures issue number CVE-2018-5391.
A remote attacker could use large IP frames to trigger time and calculation expensive calls in the reassembly of the packets. This could could lead to CPU saturation and possible reset and termination of the service processor. Changes were made to lower the IP fragment threshold values to prevent the attack.

Vulnerability Details

CVEID: CVE-2018-5391
DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused by the improper handling of the reassembly of fragmented IPv4 and IPv6 packets by the IP implementation. By sending specially crafted IP fragments with random offsets, a remote attacker could exploit this vulnerability to exhaust all available CPU resources and cause a denial of service.
CVSS Base Score: 7.5
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/148388&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Firmware release FW910 and FW920 are affected.

Remediation/Fixes

Customers with the products below, install FW910.30

1. IBM Power Systems S922 (9009-22A)
2. IBM Power Systems H922 (9223-22H)
3. IBM Power Systems S914 (9009-41A)
4. IBM Power Systems S924 (9009-42A)
5. IBM Power Systems H924 (9223-42H)
6. IBM Power Systems L922 (9008-22L)

Customers with the products below, install FW920.30

1. IBM Power Systems E950(9040-MR9)

2. IBM Power Systems E980(9080-M9S)

Workarounds and Mitigations