Host-Firmware Parsing Buffer Overflow in IBM PowerVM Hypervisor

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the service processor can write specially crafted configuration data, causing the host firmware boot stack to crash with possible memory corruption during system initialisation, resulting in an integrity and availability impact to the managed system.

IBM identifies the following scope:

• IBM PowerVM Hypervisor: FW1060.00 through FW1060.81, inclusive, is affected.
• IBM lists these Power 10 platforms as remediation targets: IBM Power System S1022, S1024, S1022s, S1014, L1022, L1024, E1050, and S1012.
• IBM also records a fix in separate Power11 firmware branches, but the available evidence does not provide affected-version boundaries for those branches. Do not infer that Power11 branches are unaffected solely because this record lists FW1060.00 through FW1060.81.

IBM states that its affected-product list is intended for supported products. Omission of an unsupported or extended-support product or version is not evidence that it is unaffected.

IBM PowerVM Hypervisor in Power Systems Firmware processes host configuration data during system initialisation. An attacker with authenticated service-level access to the service processor can write specially crafted configuration data to the managed system. When the data is parsed, the host firmware boot stack can crash with possible memory corruption. The flaw is classified as CWE-121, consistent with a possible stack-based buffer overflow in the configuration parsing component. The supplied vector indicates no user interaction, low attack complexity, authenticated access requirements, and a changed impact scope from the service processor context to the managed host. The available evidence does not identify the specific configuration field, parsing function, memory layout, or whether reliable arbitrary code execution is possible.

Exploitation requires authenticated service-level access to the service processor. The supplied vector indicates a local attack vector, low attack complexity, low privileges required, and no user interaction. Specially crafted configuration data can be written to the system and then processed during host firmware initialisation. The supplied record marks public_exploit as false, but that status does not prove that exploitation has never occurred. The available evidence identifies no campaign, victim, public exploit, or observed exploitation activity.

When malicious configuration data is processed by host firmware, the boot stack can crash during system initialisation with possible memory corruption. The documented outcome is availability impact to the managed system and possible integrity impact. The supplied vector indicates changed scope, consistent with impact crossing from the service processor context to the managed host. The record does not indicate a confidentiality impact and does not establish arbitrary code execution, persistence, or complete host takeover. Organisational consequences may include recovery work, reboot or maintenance requirements, and disruption to workloads dependent on the affected system.

The flaw can crash the host firmware boot stack during system initialisation, preventing a managed system from booting or interrupting service. Possible memory corruption may create an integrity impact, but the available evidence does not establish arbitrary modification, persistence, or code execution. The record does not indicate a confidentiality impact or data disclosure. Exploitation requires authenticated service-level access to the service processor, so exposure is concentrated in privileged management accounts and access paths. PowerVM Hypervisor systems in the affected firmware range should be prioritised for update during an appropriate maintenance window.

1. On the Power 10 platforms listed by IBM, install FW1060.82 (1060_199) or a newer release as directed by IBM to remediate the issue.
2. Obtain the firmware image from IBM Fix Central and confirm the correct system model before deployment.
3. After updating, verify the running and activated firmware levels and confirm that the system completes boot and system initialisation normally.
4. For Power11 branches, IBM fix history records the fix in FW1110.32 and FW1120.02, but it does not state the affected lower bounds. Confirm branch- and model-specific applicability with IBM before treating these as universal remediation points.
5. IBM lists no workaround or mitigation. While awaiting the update, restricting and reviewing service-level access is a defensive precaution, not an IBM-confirmed workaround.

1. Inventory IBM Power Systems running IBM PowerVM Hypervisor and identify the active host firmware level.
2. Flag systems in the FW1060.00 through FW1060.81 range for priority handling.
3. Identify Power 10 systems listed by IBM and verify both the running firmware and the activated firmware image.
4. Review service processor audit or event logs for authenticated service-level logins and configuration write or change operations before boot or system initialisation failures.
5. Check for boot stack crashes, memory corruption reports, or systems that fail to complete initialisation after configuration data is changed. These are symptoms consistent with the vulnerability, not unique IOCs.
6. IBM does not provide a specific log event or IOC for this issue; absence of matching log evidence does not prove that a system is safe.