Vulnerability Name:

CVE-2018-9085 (CCN-153019)

Assigned:2018-11-15
Published:2018-11-15
Updated:2019-10-03
Summary:A write protection lock bit was left unset after boot on an older generation of Lenovo and IBM System x servers, potentially allowing an attacker with administrator access to modify the subset of flash memory containing Intel Server Platform Services (SPS) and the system Flash Descriptors.
CVSS v3 Severity:4.9 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N)
4.3 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): High
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): High
Availibility (A): None
5.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
4.8 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
CVSS v2 Severity:4.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
4.6 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:N/I:N/A:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Complete
Vulnerability Type:CWE-276
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2018-9085

Source: CCN
Type: IBM Security Bulletin 741657 (BladeCenter HS23 7875)
Denial of service vulnerability affects IBM Unified Extensible Firmware Interface (CVE-2018-9085)

Source: XF
Type: UNKNOWN
lenovo-cve20189085-dos(153019)

Source: CCN
Type: Lenovo Security Advisory: LEN-24477
Missing System x Flash Memory Write Protection Lock Bit

Source: CONFIRM
Type: Vendor Advisory
https://support.lenovo.com/us/en/solutions/LEN-24477

Vulnerable Configuration:Configuration 1:
  • cpe:/o:lenovo:flex_system_x240_m4_firmware:*:*:*:*:*:*:*:* (Version < a3e122b)
  • AND
  • cpe:/h:lenovo:flex_system_x240_m4:-:*:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/o:lenovo:flex_system_x440_m4_firmware:*:*:*:*:*:*:*:* (Version < cge122b)
  • AND
  • cpe:/h:lenovo:flex_system_x440_m4:-:*:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/o:lenovo:system_x3750_m4_firmware:*:*:*:*:*:*:*:* (Version < a5e124b)
  • AND
  • cpe:/h:lenovo:system_x3750_m4:-:*:*:*:*:*:*:*

    • Configuration 4:
  • cpe:/o:ibm:bladecenter_hs23_firmware:*:*:*:*:*:*:*:* (Version < tke160c)
  • AND
  • cpe:/h:ibm:bladecenter:hs23:-:*:*:*:*:*:*

    • Configuration 5:
  • cpe:/o:ibm:bladecenter_hs23e_firmware:*:*:*:*:*:*:*:* (Version < ahe160c)
  • AND
  • cpe:/h:ibm:bladecenter:hs23e:-:*:*:*:*:*:*

    • Configuration 6:
  • cpe:/o:ibm:flex_system_x220_m4_firmware:*:*:*:*:*:*:*:* (Version < kse158c)
  • AND
  • cpe:/h:ibm:flex_system_x220:-:*:*:*:*:*:*:*

    • Configuration 7:
  • cpe:/o:ibm:flex_system_x222_m4_firmware:*:*:*:*:*:*:*:* (Version < cce160c)
  • AND
  • cpe:/h:ibm:flex_system_x222_m4:-:*:*:*:*:*:*:*

    • Configuration 8:
  • cpe:/o:ibm:flex_system_x240_m4_firmware:*:*:*:*:*:*:*:* (Version < ahe160c)
  • AND
  • cpe:/h:ibm:flex_system_x240_m4:-:*:*:*:*:*:*:*

    • Configuration 9:
  • cpe:/o:ibm:flex_system_x280_x6_firmware:*:*:*:*:*:*:*:* (Version < n3e132w)
  • AND
  • cpe:/h:ibm:flex_system_x280_x6:-:*:*:*:*:*:*:*

    • Configuration 10:
  • cpe:/o:ibm:flex_system_x440_m4_firmware:*:*:*:*:*:*:*:* (Version < cne162d)
  • AND
  • cpe:/h:ibm:flex_system_x440_m4:-:*:*:*:*:*:*:*

    • Configuration 11:
  • cpe:/o:ibm:flex_system_x480_x6_firmware:*:*:*:*:*:*:*:* (Version < n3e132w)
  • AND
  • cpe:/h:ibm:flex_system_x480_x6:-:*:*:*:*:*:*:*

    • Configuration 12:
  • cpe:/o:ibm:flex_system_x880_x6_firmware:*:*:*:*:*:*:*:* (Version < n2e130e)
  • AND
  • cpe:/h:ibm:flex_system_x880_x6:-:*:*:*:*:*:*:*

    • Configuration 13:
  • cpe:/o:ibm:idataplex_dx360_m4_firmware:*:*:*:*:*:*:*:* (Version < fhe120d)
  • AND
  • cpe:/h:ibm:idataplex_dx360_m4_:-:*:*:*:*:*:*:*

    • Configuration 14:
  • cpe:/o:ibm:idataplex_dx360_m4_water_cooled_firmware:*:*:*:*:*:*:*:* (Version < fhe120d)
  • AND
  • cpe:/h:ibm:idataplex_dx360_m4_:-:*:*:*:*:*:*:*

    • Configuration 15:
  • cpe:/o:ibm:system_x3100_m4_firmware:*:*:*:*:*:*:*:* (Version < jqe184c)
  • AND
  • cpe:/h:ibm:system_x3100_m4:*:*:*:*:*:*:*:*

    • Configuration 16:
  • cpe:/o:ibm:system_x3100_m5_firmware:*:*:*:*:*:*:*:* (Version < j9e134c)
  • AND
  • cpe:/h:ibm:system_x3100_m5:*:*:*:*:*:*:*:*

    • Configuration 17:
  • cpe:/o:ibm:system_x3250_m4_firmware:*:*:*:*:*:*:*:* (Version < jqe184c)
  • AND
  • cpe:/h:ibm:system_x3250_m4:*:*:*:*:*:*:*:*

    • Configuration 18:
  • cpe:/o:ibm:system_x3250_m5_firmware:*:*:*:*:*:*:*:* (Version < jue134c)
  • AND
  • cpe:/h:ibm:system_x3250_m5:*:*:*:*:*:*:*:*

    • Configuration 19:
  • cpe:/o:ibm:system_x3300_m4_firmware:*:*:*:*:*:*:*:* (Version < yae156c)
  • AND
  • cpe:/h:ibm:system_x3300_m4:*:*:*:*:*:*:*:*

    • Configuration 20:
  • cpe:/o:ibm:system_x3500_m4_firmware:*:*:*:*:*:*:*:* (Version < y5e158c)
  • AND
  • cpe:/h:ibm:system_x3500_m4:*:*:*:*:*:*:*:*

    • Configuration 21:
  • cpe:/o:ibm:system_x3530_m4_firmware:*:*:*:*:*:*:*:* (Version < bee164c)
  • AND
  • cpe:/h:ibm:system_x3530_m4:*:*:*:*:*:*:*:*

    • Configuration 22:
  • cpe:/o:ibm:system_x3550_m4_firmware:*:*:*:*:*:*:*:* (Version < d7e166d)
  • AND
  • cpe:/h:ibm:system_x3550_m4:*:*:*:*:*:*:*:*

    • Configuration 23:
  • cpe:/o:ibm:system_x3630_m4_firmware:*:*:*:*:*:*:*:* (Version < vve162c)
  • AND
  • cpe:/h:ibm:system_x3630_m4:*:*:*:*:*:*:*:*

    • Configuration 24:
  • cpe:/o:ibm:system_x3650_m4_firmware:*:*:*:*:*:*:*:* (Version < vve160c)
  • AND
  • cpe:/h:ibm:system_x3650_m4:*:*:*:*:*:*:*:*

    • Configuration 25:
  • cpe:/o:ibm:system_x3650_m4_bd_firmware:*:*:*:*:*:*:*:* (Version < vve160c)
  • AND
  • cpe:/h:ibm:system_x3650_m4_bd:*:*:*:*:*:*:*:*

    • Configuration 26:
  • cpe:/o:ibm:system_x3650_m4_hd_firmware:*:*:*:*:*:*:*:* (Version < vve160c)
  • AND
  • cpe:/h:ibm:system_x3650_m4_hd:*:*:*:*:*:*:*:*

    • Configuration 27:
  • cpe:/o:ibm:system_x3750_m4_firmware:*:*:*:*:*:*:*:* (Version < koe160c)
  • AND
  • cpe:/h:ibm:system_x3750_m4:*:*:*:*:*:*:*:*

    • Configuration 28:
  • cpe:/o:ibm:system_x3850_x6_firmware:*:*:*:*:*:*:*:* (Version < a8e128c)
  • AND
  • cpe:/h:ibm:system_x3850_x6:*:*:*:*:*:*:*:*

    • Configuration 29:
  • cpe:/o:ibm:system_x3950_x6_firmware:*:*:*:*:*:*:*:* (Version < bee164c)
  • AND
  • cpe:/h:ibm:system_x3950_x6:*:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/h:lenovo:flex_system_x240_m4:-:*:*:*:*:*:*:*
  • OR cpe:/h:lenovo:flex_system_x440_m4:-:*:*:*:*:*:*:*
  • OR cpe:/h:lenovo:flex_system_x480_x6:-:*:*:*:*:*:*:*
  • OR cpe:/h:lenovo:flex_system_x880:-:*:*:*:*:*:*:*
  • OR cpe:/h:lenovo:system_x3750_m4:-:*:*:*:*:*:*:*
  • OR cpe:/a:lenovo:system_x3250_m5:5.05:*:*:*:*:*:*:*
  • OR cpe:/h:lenovo:system_x3750_m4:-:*:*:*:*:*:*:*
  • OR cpe:/h:lenovo:system_x3850_x6:-:*:*:*:*:*:*:*
  • OR cpe:/h:lenovo:system_x3950_x6:-:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    lenovo flex system x240 m4 firmware *
    lenovo flex system x240 m4 -
    lenovo flex system x440 m4 firmware *
    lenovo flex system x440 m4 -
    lenovo system x3750 m4 firmware *
    lenovo system x3750 m4 -
    ibm bladecenter hs23 firmware *
    ibm bladecenter hs23 -
    ibm bladecenter hs23e firmware *
    ibm bladecenter hs23e -
    ibm flex system x220 m4 firmware *
    ibm flex system x220 -
    ibm flex system x222 m4 firmware *
    ibm flex system x222 m4 -
    ibm flex system x240 m4 firmware *
    ibm flex system x240 m4 -
    ibm flex system x280 x6 firmware *
    ibm flex system x280 x6 -
    ibm flex system x440 m4 firmware *
    ibm flex system x440 m4 -
    ibm flex system x480 x6 firmware *
    ibm flex system x480 x6 -
    ibm flex system x880 x6 firmware *
    ibm flex system x880 x6 -
    ibm idataplex dx360 m4 firmware *
    ibm idataplex dx360 m4 -
    ibm idataplex dx360 m4 water cooled firmware *
    ibm idataplex dx360 m4 -
    ibm system x3100 m4 firmware *
    ibm system x3100 m4 *
    ibm system x3100 m5 firmware *
    ibm system x3100 m5 *
    ibm system x3250 m4 firmware *
    ibm system x3250 m4 *
    ibm system x3250 m5 firmware *
    ibm system x3250 m5 *
    ibm system x3300 m4 firmware *
    ibm system x3300 m4 *
    ibm system x3500 m4 firmware *
    ibm system x3500 m4 *
    ibm system x3530 m4 firmware *
    ibm system x3530 m4 *
    ibm system x3550 m4 firmware *
    ibm system x3550 m4 *
    ibm system x3630 m4 firmware *
    ibm system x3630 m4 *
    ibm system x3650 m4 firmware *
    ibm system x3650 m4 *
    ibm system x3650 m4 bd firmware *
    ibm system x3650 m4 bd *
    ibm system x3650 m4 hd firmware *
    ibm system x3650 m4 hd *
    ibm system x3750 m4 firmware *
    ibm system x3750 m4 *
    ibm system x3850 x6 firmware *
    ibm system x3850 x6 *
    ibm system x3950 x6 firmware *
    ibm system x3950 x6 *
    lenovo flex system x240 m4 -
    lenovo flex system x440 m4 -
    lenovo flex system x480 x6 -
    lenovo flex system x880 -
    lenovo system x3750 m4 -
    lenovo system x3250 m5 5.05
    lenovo system x3750 m4 -
    lenovo system x3850 x6 -
    lenovo system x3950 x6 -