CVE-2023-30438

published 2023-05-17

CVE-2023-30438: An internally discovered vulnerability in PowerVM on IBM Power9 and Power10 systems could allow an attacker with privileged user access to a logical partition…

Priority P3 46 high 8.8 CVSS 3.1

AV L AC L PR L UI N S C C H I H A H

An internally discovered vulnerability in PowerVM on IBM Power9 and Power10 systems could allow an attacker with privileged user access to a logical partition to perform an undetected violation of the isolation between logical partitions which could lead to data leakage or the execution of arbitrary code in other logical partitions on the same physical server. IBM X-Force ID: 252706.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
ibm	powervm_hypervisor	FW1010.00 – FW1010.50	—
ibm	powervm_hypervisor	FW1020.00 – FW1020.30	—
ibm	powervm_hypervisor	FW1030.00 – FW1030.10	—
ibm	powervm_hypervisor	FW950.00 – FW950.70	—
ibm	powervm_hypervisor	>= fw1010.00 < fw1010.51	fw1010.51
ibm	powervm_hypervisor	>= fw1020.00 < fw1020.31	fw1020.31
ibm	powervm_hypervisor	>= fw1030.00 < fw1030.11	fw1030.11
ibm	powervm_hypervisor	>= fw950 < fw950.71	fw950.71

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.