CVE-2023-30438

Critical

Description

An internally discovered vulnerability in PowerVM on IBM Power9 and Power10 systems could allow an attacker with privileged user access to a logical partition to perform an undetected violation of the isolation between logical partitions which could lead to data leakage or the execution of arbitrary code in other logical partitions on the same physical server. IBM X-Force ID: 252706.

SeverityCritical

CVSS9.3

Exploit probability—

Product

Ibm Powervm Hypervisor

PublishedMay 17, 2023

First seenMay 17, 2023

How to fix

Update

ibm powervm_hypervisorfw950.71, fw1010.51, fw1030.11, fw1020.31 or later

Vendor advisories

ibm.com/support/pages/node/6993021

Affected products

Product	Affected versions	Fixed in
ibm powervm_hypervisor	fw950 ≤ v < fw950.71, fw1010.00 ≤ v < fw1010.51, fw1030.00 ≤ v < fw1030.11, fw1020.00 ≤ v < fw1020.31	fw950.71, fw1010.51, fw1030.11, fw1020.31

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.