by Kastro
Paper/Archive/CVE-2023-30438

CVE-2023-30438

IBM PowerVM Hypervisor — IBM PowerVM gain access

EPSS 0.2%CVSS 9.3
critical.is priorityof 100
31
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 14.7.147 × 202.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An internally discovered vulnerability in PowerVM on IBM Power9 and Power10 systems could allow an attacker with privileged user access to a logical partition to perform an undetected violation of the isolation between logical partitions which could lead to data leakage or the execution of arbitrary code in other logical partitions on the same physical server. IBM X-Force ID: 252706.

Affected

ProductAffectedFixed inSource
PowerVM HypervisorFW950.00 – FW950.70–CNA
PowerVM HypervisorFW1010.00 – FW1010.50–CNA
PowerVM HypervisorFW1020.00 – FW1020.30–CNA
PowerVM HypervisorFW1030.00 – FW1030.10–CNA

Scores by source

ibm (CNA)9.3CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisoryibm.com/support/pages/node/6993021refexchange.xforce.ibmcloud.com/vulnerabilities/252706