Strix
26.1K

CVE-2018-1992

MEDIUMCVSS 6.4/10EPSS 0.35%

Last modified

CVE-2018-1992 is a medium-severity vulnerability rated 6.4/10 on the CVSS scale. The IBM Power 9 OP910, OP920, and FW910 boot firmware's bootloader is responsible for loading and validating the initial boot firmware image that drives the rest of the system's hardware initialization. The bootloader firmware contains a buffer overflow vulnerability such that, if an attacker were able to replace the initial boot firmware image with a very carefully crafted and sufficiently large, malicious replacement, it could cause the bootloader, during the load of that image, to overwrite its own instruction memory and circumvent secure boot protections, install trojans, etc. EPSS estimates a 0.35% chance of exploitation in the next 30 days.

Description

The IBM Power 9 OP910, OP920, and FW910 boot firmware's bootloader is responsible for loading and validating the initial boot firmware image that drives the rest of the system's hardware initialization. The bootloader firmware contains a buffer overflow vulnerability such that, if an attacker were able to replace the initial boot firmware image with a very carefully crafted and sufficiently large, malicious replacement, it could cause the bootloader, during the load of that image, to overwrite its own instruction memory and circumvent secure boot protections, install trojans, etc. IBM X-Force ID: 154345.

Metrics

CVSS 3.0
6.4/10

CVSS:3.0/PR:H/AV:L/S:U/I:H/UI:N/AC:H/A:H/C:H/RC:C/E:U/RL:O

EPSS Probability
0.35%

27.2th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
IbmPower System S922 \(9009-22a\) Firmware< fw910.10
IbmPower System H922 \(9223-22h\) Firmware< fw910.10
IbmPower System S914 \(9009-41a\) Firmware< fw910.10
IbmPower System S924 \(9009-42a\) Firmware< fw910.10
IbmPower System H924 \(9223-42h\) Firmware< fw910.10
IbmPower System L922 \(9008-22l\) Firmware< fw910.10
IbmPower System Ac922 \(8335-Gtg\) Firmware< op910.30
IbmPower System Ac922 \(8335-Gth\) Firmware< op920.10
IbmPower System Ac922 \(8335-Gtx\) Firmware< op920.10
IbmPower System Lc921 \(9006-12p\) Firmware< op920.10
IbmPower System Lc922 \(9006-22p\) Firmware< op920.10

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2018-1992?
The IBM Power 9 OP910, OP920, and FW910 boot firmware's bootloader is responsible for loading and validating the initial boot firmware image that drives the rest of the system's hardware initialization. The bootloader firmware contains a buffer overflow vulnerability such that, if an attacker were able to replace the initial boot firmware image with a very carefully crafted and sufficiently large, malicious replacement, it could cause the bootloader, during the load of that image, to overwrite its own instruction memory and circumvent secure boot protections, install trojans, etc. IBM X-Force ID: 154345.
How severe is CVE-2018-1992?
CVE-2018-1992 has a CVSS score of 6.4/10 (MEDIUM severity). The EPSS model estimates a 0.35% probability of exploitation in the next 30 days.
How do I fix CVE-2018-1992?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2018

View all 2018CVEs →

Are you affected by CVE-2018-1992?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST