Security Bulletin: An attacker that gains service access to the FSP (POWER9 only) or gains admin authority to a partition can compromise partition firmware.

Summary

PowerVM partition firmware is the portion that executes in each partition during boot. On POWER9 systems an attacker that gains service access to the FSP can compromise partition firmware for any partition configured on the system. On all affected systems an attacker that gains admin authority to a partition can compromise partition firmware for that partition.

Vulnerability Details

CVEID:CVE-2022-22445
**DESCRIPTION:**An attacker that gains service access to the FSP (POWER9 only) or gains admin authority to a partition can compromise partition firmware.
CVSS Base score: 7.6
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/224546 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L)

Affected Products and Versions

Remediation/Fixes

Customers with the products below should install FW950.40(Vx950_099), FW1010.32(MH1010_135) or newer to remediate this concern.

Power 9

1. IBM Power System S922 (9009-22A, 9009-22G)

2. IBM Power System H922 (9223-22H, 9223-22S)

3. IBM Power System S914 (9009-41A, 9009-41G)

4. IBM Power System S924 (9009-42A, 9009-42G)

5. IBM Power System H924 (9223-42H, 9223-42S)

6. IBM Power System E950 (9040-MR9)

7. IBM Power System E980 (9080-M98, 9080-M9S)

Power 10

1. IBM Power System E1080 (9080-HEX)

Workarounds and Mitigations

None