IBM PowerVM gain access
CVE-2023-30438

9.3CRITICAL

Key Information:

Vendor
IBM
Status
Powervm Hypervisor
Vendor
CVE Published:
17 May 2023

Summary

An internally discovered vulnerability in PowerVM on IBM Power9 and Power10 systems allows an attacker with privileged user access to a logical partition to breach isolation between partitions. This could result in unauthorized data access or execution of arbitrary code in neighboring logical partitions on the same physical hardware.

Affected Version(s)

PowerVM Hypervisor FW950.00

PowerVM Hypervisor FW1010.00

PowerVM Hypervisor FW1020.00

References

https://www.ibm.com/support/pages/node/6993021
vendor-advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/252706
vdb-entry

CVSS V3.1

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.