Lucene search

HistoryDec 07, 2021 - 7:14 p.m.

Security Bulletin: This Power System update is being released to address CVE-2018-5390


0.783 High





POWER9: In response to a denial of service vulnerability, a new Power Systems firmware update is being released to address Common Vulnerabilities and Exposures issue number CVE-2018-5390.

Vulnerability Details

CVEID: CVE-2018-5390 DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused by an error in the tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() functions. By sending specially crafted packets within ongoing TCP sessions, a remote attacker could exploit this vulnerability to cause a denial of service.
CVSS Base Score: 7.5
CVSS Temporal Score: See <; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Firmware release FW910 and FW920 are affected.


Customers with the products below, install FW910.30

  1. IBM Power Systems S922 (9009-22A)
  2. IBM Power Systems H922 (9223-22H)
  3. IBM Power Systems S914 (9009-41A)
  4. IBM Power Systems S924 (9009-42A)
  5. IBM Power Systems H924 (9223-42H)
  6. IBM Power Systems L922 (9008-22L)

Customers with the products below, install FW920.30

  1. IBM Power Systems E950(9040-MR9)

  2. IBM Power Systems E980(9080-M9S)