medium4.9
CVE-2018-9085
A write protection lock bit was left unset after boot on an older generation of Lenovo and IBM System x servers, potentially allowing an attacker with administ…
Impact
A write protection lock bit was left unset after boot on an older generation of Lenovo and IBM System x servers, potentially allowing an attacker with administrator access to modify the subset of flash memory containing Intel Server Platform Services (SPS) and the system Flash Descriptors.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Lenovo | Flex System X240 M4 Firmware | before a3e122b |
| Lenovo | Flex System X440 M4 Firmware | before cge122b |
| Lenovo | System X3750 M4 Firmware | before a5e124b |
| Ibm | Bladecenter Hs23 Firmware | before tke160c |
| Ibm | Bladecenter Hs23e Firmware | before ahe160c |
| Ibm | Flex System X220 M4 Firmware | before kse158c |
| Ibm | Flex System X222 M4 Firmware | before cce160c |
| Ibm | Flex System X240 M4 Firmware | before ahe160c |
| Ibm | Flex System X280 X6 Firmware | before n3e132w |
| Ibm | Flex System X440 M4 Firmware | before cne162d |
| Ibm | Flex System X480 X6 Firmware | before n3e132w |
| Ibm | Flex System X880 X6 Firmware | before n2e130e |