CVE-2021-36357
📋 TL;DR
This vulnerability in OpenPOWER firmware allows attackers to bypass timestamp validation checks due to a type mismatch in endian conversion. This could enable firmware manipulation or system compromise. It affects systems running OpenPOWER firmware version 2.6.
💻 Affected Systems
- OpenPOWER skiboot firmware
📦 What is this software?
Skiboot by Openpowerfoundation
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through firmware manipulation, potentially allowing persistent backdoors or bricking systems.
Likely Case
Firmware integrity bypass enabling unauthorized modifications to system firmware.
If Mitigated
Limited impact if firmware validation controls are in place and systems are air-gapped.
🎯 Exploit Status
Exploitation requires firmware access and understanding of OpenPOWER architecture.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit 5be38b672c1410e2f10acd3ad2eecfdc81d5daf7 and later
Vendor Advisory: https://github.com/open-power/skiboot/commit/5be38b672c1410e2f10acd3ad2eecfdc81d5daf7
Restart Required: Yes
Instructions:
1. Update skiboot firmware to version containing commit 5be38b672c1410e2f10acd3ad2eecfdc81d5daf7
2. Reflash firmware on affected systems
3. Reboot systems to apply new firmware
🔧 Temporary Workarounds
Restrict firmware access
allLimit physical and administrative access to firmware management interfaces
🧯 If You Can't Patch
- Implement strict access controls to firmware management interfaces
- Monitor for unauthorized firmware modification attempts
🔍 How to Verify
Check if Vulnerable:
Check skiboot version: cat /proc/device-tree/ibm,firmware-versionsCheck Version:
cat /proc/device-tree/ibm,firmware-versions | grep skibootVerify Fix Applied:
Verify skiboot version includes commit 5be38b672c1410e2f10acd3ad2eecfdc81d5daf7📡 Detection & Monitoring
Log Indicators:
- Unexpected firmware modification logs
- Failed firmware validation attempts
Network Indicators:
- Unauthorized access to firmware management interfaces
SIEM Query:
source="firmware_logs" AND (event="modification" OR event="validation_failure")