Description

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the service processor can write specially crafted configuration data, causing the host firmware boot stack to crash with possible memory corruption during system initialisation, resulting in an integrity and availability impact to the managed system.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-19T20:17:13.763Z",
  "pubdate": "2026-08-19T20:17:13.763Z",
  "executiveSummary": "A vulnerability exists in the host firmware configuration parsing mechanism of the IBM PowerVM Hypervisor, specifically affecting versions FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80.\nThe vulnerability involves improper handling of configuration data written to the service processor, resulting in host firmware boot stack crashes and potential memory corruption during system initialization.\nSuccessful exploitation of this flaw leads to an integrity and availability impact on the managed system, rendering the host firmware incapable of booting securely or correctly.\nExploitation requires an attacker to possess authenticated service-level access to the service processor, allowing them to supply specially crafted configuration data.\nThe risk implications are severe, as the integrity of the boot process and the continuous availability of the managed hypervisor environment are directly compromised by unauthorized or malicious configuration inputs.",
  "technicalDetails": "The vulnerability resides within the host firmware configuration parsing component of the IBM PowerVM Hypervisor.\nThe root cause stems from insecure parsing and processing of configuration data supplied via the service processor.\nAffected software versions include IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80.\nExploitation prerequisites dictate that an attacker must first obtain authenticated service-level access to the underlying service processor.\nThe attack flow proceeds as follows: 1) The authenticated attacker interacts with the service processor interface. 2) The attacker writes specially crafted configuration data into the firmware configuration storage or transmission channel. 3) Upon system initialization or reboot, the vulnerable host firmware parser processes the malicious configuration data without proper bounds checking or validation. 4) The improper processing causes the host firmware boot stack to crash. 5) During the crash and subsequent abnormal termination, memory corruption occurs within the initialization routines.\nThe payload behavior involves supplying structurally anomalous configuration parameters that trigger stack-based corruptions or parsing exceptions during early boot stages.\nThe post-exploitation impact is manifested as a denial of service through system initialization failure and a loss of system integrity due to potential unauthorized memory modification during the boot sequence."
}