CVE Feed

    Dashboard / CVE / CVE-2018-1992

    CVE-2018-1992

    The IBM Power 9 OP910, OP920, and FW910 boot firmware's bootloader is responsible for loading and validating the initial boot firmware image that drives the rest of the system's hardware initialization. The bootloader firmware contains a buffer overflow vulnerability such that, if an attacker were able to replace the initial boot firmware image with a very carefully crafted and sufficiently large, malicious replacement, it could cause the bootloader, during the load of that image, to overwrite its own instruction memory and circumvent secure boot protections, install trojans, etc. IBM X-Force ID: 154345.

    Published:Mar 21, 2019
    Last Modified:Nov 21, 2024
    EPS:Mar 21, 2019
    EPSS Score:0.00042
    CVSS Score:6.4

    Affected Products

    Vendor
    Ibm
    Product
    Power System Ac922 \(8335-gtg\)
    Vendor
    Ibm
    Product
    Power System Ac922 \(8335-gtg\) Firmware
    Vendor
    Ibm
    Product
    Power System Ac922 \(8335-gth\)
    Vendor
    Ibm
    Product
    Power System Ac922 \(8335-gth\) Firmware
    Vendor
    Ibm
    Product
    Power System Ac922 \(8335-gtx\)
    Vendor
    Ibm
    Product
    Power System Ac922 \(8335-gtx\) Firmware
    Vendor
    Ibm
    Product
    Power System H922 \(9223-22h\)
    Vendor
    Ibm
    Product
    Power System H922 \(9223-22h\) Firmware
    Vendor
    Ibm
    Product
    Power System H924 \(9223-42h\)
    Vendor
    Ibm
    Product
    Power System H924 \(9223-42h\) Firmware
    Vendor
    Ibm
    Product
    Power System L922 \(9008-22l\)
    Vendor
    Ibm
    Product
    Power System L922 \(9008-22l\) Firmware
    Vendor
    Ibm
    Product
    Power System Lc921 \(9006-12p\)
    Vendor
    Ibm
    Product
    Power System Lc921 \(9006-12p\) Firmware
    Vendor
    Ibm
    Product
    Power System Lc922 \(9006-22p\)
    Vendor
    Ibm
    Product
    Power System Lc922 \(9006-22p\) Firmware
    Vendor
    Ibm
    Product
    Power System S914 \(9009-41a\)
    Vendor
    Ibm
    Product
    Power System S914 \(9009-41a\) Firmware
    Vendor
    Ibm
    Product
    Power System S922 \(9009-22a\)
    Vendor
    Ibm
    Product
    Power System S922 \(9009-22a\) Firmware
    Vendor
    Ibm
    Product
    Power System S924 \(9009-42a\)
    Vendor
    Ibm
    Product
    Power System S924 \(9009-42a\) Firmware

    Exploits

    No exploit reference

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High