PT-2021-21249 · Openpower · Openpower

Published 2021-10-22 · Updated 2021-10-27 · CVE-2021-36357

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenPOWER version 2.6

Description An issue was discovered in the OpenPOWER firmware. The unpack timestamp() function calls le32 to cpu() for endian conversion of a uint16 t "year" value, resulting in a type mismatch that can truncate a higher integer value to a smaller one, and bypass a timestamp check.

Recommendations For OpenPOWER version 2.6, the fix is to use the right endian conversion function.

Fix

Weakness Enumeration

CWE-681

Related Identifiers

CVE-2021-36357

Affected Products

Openpower

References · 5

• https://github.com/open-power/skiboot/commit/5be38b672c1410e2f10acd3ad2eecfdc81d5daf7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-36357 · Security Note
• https://osv.dev/vulnerability/CVE-2021-36357 · Vendor Advisory
• https://t.me/cibsecurity/31023 · Telegram Post
• https://t.me/cvenotify/22461 · Telegram Post