Description

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can send a specially crafted mailbox message to read or modify arbitrary regions of Hostboot memory, compromising the host firmware boot stack and the hypervisor subsequently loaded by it. Successful exploitation results in a confidentiality, integrity, and availability impact to the managed system.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-19T20:17:02.140Z",
  "pubdate": "2026-08-19T20:17:02.140Z",
  "executiveSummary": "A vulnerability has been identified in the IBM PowerVM Hypervisor service processor mailbox interface, affecting multiple firmware versions including FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2. The vulnerability resides within the service processor mailbox interface component and arises from insufficient validation of mailbox messages processed by the firmware.\nSuccessful exploitation of this vulnerability requires an attacker to possess authenticated service-level access to the Flexible Service Processor (FSP). With these prerequisites met, an adversary can transmit specially crafted mailbox messages designed to interact with the underlying memory management routines of the subsystem.\nThe technical impact of successful exploitation is severe, granting the attacker the capability to read or modify arbitrary regions of Hostboot memory. This unauthorized manipulation compromises the integrity of the host firmware boot stack, allowing an adversary to subvert the boot process and subsequently compromise the hypervisor loaded by it. Consequently, exploitation results in a complete loss of confidentiality, integrity, and availability for the entire managed system, posing critical risk to environments utilizing the affected IBM PowerVM Hypervisor firmware versions.",
  "technicalDetails": "The vulnerability is located in the service processor mailbox interface of the IBM PowerVM Hypervisor firmware. This interface is responsible for handling inter-processor and intra-subsystem communications, specifically managing control messages and data exchanges between the Flexible Service Processor (FSP) and the Hostboot environment.\nThe root cause of the vulnerability stems from inadequate input validation and boundary checking within the mailbox message parsing logic. When the FSP receives a mailbox message, the interface fails to properly restrict or sanitize the target memory addresses and operation parameters specified within the message payload.\nTo exploit this vulnerability, an attacker must first obtain authenticated service-level access to the FSP. Once authenticated, the attacker constructs a malicious payload encapsulated within a specially crafted mailbox message. This message is then transmitted through the service processor mailbox interface.\nUpon receiving the crafted message, the vulnerable parsing routines process the instruction without enforcing adequate access controls or bounds verification. As a result, the interface interprets the malicious parameters and executes read or write operations against arbitrary memory regions within the Hostboot memory space.\nThe post-exploitation impact allows the adversary to modify the host firmware boot stack during the initialization phase. Because the Hostboot sequence establishes the foundational trust and integrity for the platform, tampering with this region leads directly to the compromise of the hypervisor that is subsequently loaded. This grants the attacker deep persistence and full control over the execution environment, culminating in a total compromise of confidentiality, integrity, and availability for the managed system.\nAffected products and versions include IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2. The attack vector requires authenticated service-level access to the FSP, meaning network exposure and privilege requirements are constrained to administrative or service interfaces governing the service processor."
}