CVE:CVE-2018-1992
CNNVD:CNNVD-201903-694
IBM Power System S922等都是美国IBM公司的一款基于Power处理器的服务器设备。
多款IBM产品中的boot loader存在缓冲区错误漏洞。攻击者可利用该漏洞覆盖bootloader的指令内存，绕过安全启动保护，安装木马程序等。以下产品受到影：使用FW910版本固件的IBM Power System S922 (9009-22A)；使用FW910版本固件的Power System H922 (9223-22H)；使用FW910版本固件的Power System S914 (9009-41A)；使用FW910版本固件的Power System S924 (9009-42A)；使用FW910版本固件的Power System H924 (9223-42H)；使用FW910版本固件的Power System L922 (9008-22L)；Power System AC922 (8335-GTG)（运行OpenPOWER OP910版本）；Power System AC922 (8335-GTH)（运行OpenPOWER OP920版本）；Power System AC922 (8335-GTX)（运行OpenPOWER OP920版本）；Power System LC921 (9006-12P)（运行OpenPOWER OP920版本）；Power System LC922 (9006-22P)（运行OpenPOWER OP920版本）。
solution:Upgrade ibm power_system_s922_(9009-22a)_firmware to a higher version than fw910.10,and avoid the version (,fw910.10); Upgrade ibm power_system_h922_(9223-22h)_firmware to a higher version than fw910.10,and avoid the version (,fw910.10); Upgrade ibm power_system_s914_(9009-41a)_firmware to a higher version than fw910.10,and avoid the version (,fw910.10); Upgrade ibm power_system_s924_(9009-42a)_firmware to a higher version than fw910.10,and avoid the version (,fw910.10); Upgrade ibm power_system_h924_(9223-42h)_firmware to a higher version than fw910.10,and avoid the version (,fw910.10); Upgrade ibm power_system_l922_(9008-22l)_firmware to a higher version than fw910.10,and avoid the version (,fw910.10); Upgrade ibm power_system_ac922_(8335-gtg)_firmware to a higher version than op910.30,and avoid the version (,op910.30); Upgrade ibm power_system_ac922_(8335-gth)_firmware to a higher version than op920.10,and avoid the version (,op920.10); Upgrade ibm power_system_ac922_(8335-gtx)_firmware to a higher version than op920.10,and avoid the version (,op920.10); Upgrade ibm power_system_lc921_(9006-12p)_firmware to a higher version than op920.10,and avoid the version (,op920.10); Upgrade ibm power_system_lc922_(9006-22p)_firmware to a higher version than op920.10,and avoid the version (,op920.10)