IBM PowerVM Hypervisor Platform KeyStore (PKS) and virtual TPM FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H2 use persistent storage key seeds that result in an AES key with reduced strength. An attacker with access to the service processor or HMC could exploit this weakness to derive the encryption key and access the data.
Following successful application of the server firmware update, additional actions are needed. Remediating this CVE requires performing a non-disruptive Hypervisor Macro Resource Dump that regenerates the keys used to encrypt partition configuration data, Platform Keystore, and VTPM data. The instructions to issue this resource dump are listed below.
Before issuing the resource dump, confirm all of the following:
- The system is at runtime.
- There are no outstanding recovery actions (the system must not be in "Recovery" state on the HMC).
- There are no unresolved action-required PEL entries.
- The system is otherwise stable: the CEC will not be power cycled, and partition workloads are stable.
The required resource dump can be issued directly through the HMC GUI or the Advanced System Management (ASM) interface, and may take up to 30 minutes to complete:
HMC-attached systems : https://www.ibm.com/support/pages/node/667943
- Use selector: sbmgr -regenerateKeys
FSP-based standalone systems:
- Log onto the system ASM with admin credentials
- Navigate to System Service Aids -> Resource Dump
- Initiate the resource dump
- Use selector: sbmgr -regenerateKeys
BMC-based standalone systems:
- Log onto the system ASMi with admin credentials
- Navigate to Logs and Services -> Dumps -> Select a dump -> Resource Dump
- Initiate the resource dump:
- Use selector: sbmgr -regenerateKeys
For HMC managed systems, after the resource dump completes, a dump file named RSCDUMP.XXXXXXX.YYYYYYYY.ZZZZZZZZZZZZZZ, where X is the system Serial Number, Y is the dump identifier, and Z is the server UTC date and time stamp, will offload to the HMC.
To monitor for completion of the regeneration, refresh the HMC Dumps GUI, or on HMC CLI, run:
- HMC CLI (SSH): ls -ltr /dump/RSCDUMP.*
- Validate the Serial Number and date of dump.
Once the dump has offloaded to the HMC, check in the HMC’s Serviceable Event view. Event B7009021 would be an indication of a failure of this function. We recommend contacting Service for your server to review the cause of the event.
For standalone servers, the resource dump will be uploaded to the Operating System.
- Linux: Server level dumps, including Resource Dumps, will be placed in directory: /var/log/dump/. A B7009021 would present as a permanent error in the PPC64 platform log file.
- IBM i: Server level dumps, including Resource Dumps, will be copied into the Main Storage Dump Manager in System Service Tools. A B7009021 would show in the Service Action Log in System Service Tools.
- AIX: Server level dumps, including Resource Dumps, will be placed in directory: /var/adm/ras/platform/. A B7009021 would present Permanent sysplanar error in the errpt. IBM Service may be needed to determine if the event is a B7009021
Lastly: Wait at least 60 minutes after the resource dump completes before creating a new non-default backup profile on the HMC or powering off the system. This ensures all Platform Keystore and VTPM data in the profile is valid.
Customers with the products below should install FW1110.30(1110_125), FW1120.00(1120_159), or newer to remediate this vulnerability.
Power 11
- IBM Power System E1180 (9080-HEU)
Customers with the products below should install FW1110.30(1110_145), FW1120.00(1120_183), or newer to remediate this vulnerability.
Power 11
- IBM Power System S1122 (9824-22A)
- IBM Power System S1124 (9824-42A)
- IBM Power System S1122s (9824-22B)
- IBM Power System S1114 (9824-41B)
- IBM Power System L1122 (9856-22H)
- IBM Power System L1124 (9856-42H)
- IBM Power System E1150 (9043-MRU)
Customers with the products below should install FW1120.00(1120_183), or newer to remediate this vulnerability.
Power 11
- IBM Power System S1112 (9242-21B, 9242-21T)
Customers with the products below should install FW1060.72(1060_171) / FW1060.80(1060_180), or newer to remediate this vulnerability.
Power 10
- IBM Power System E1080 (9080-HEX)
Customers with the products below should install FW1060.72(1060_177) / FW1060.80(1060_185), or newer to remediate this vulnerability.
Power 10
- IBM Power System S1022 (9105-22A)
- IBM Power System S1024 (9105-42A)
- IBM Power System S1022s (9105-22B)
- IBM Power System S1014 (9105-41B)
- IBM Power System L1022 (9786-22H)
- IBM Power System L1024 (9786-42H)
- IBM Power System E1050 (9043-MRX)
- IBM Power System S1012 (9028-21B)
Customers with the products below should install FW950.H3(950_230) or newer to remediate this vulnerability.
Power 9
- IBM Power System S922 (9009-22G)
- IBM Power System H922 (9223-22S)
- IBM Power System S914 (9009-41G)
- IBM Power System S924 (9009-42G)
- IBM Power System H924 (9223-42S)
- IBM Power System E950 (9040-MR9)
- IBM Power System E980 (9080-M9S)
The images mentioned above can be located at IBM Fix Central : https://www.ibm.com/support/fixcentral/ https://www.ibm.com/support/fixcentral/