Lucene search

IbmCVE-2023-30440

HistoryMay 23, 2023 - 2:15 p.m.

CVE-2023-30440

2023-05-2314:15:09

CWE-20

ibm

web.nvd.nist.gov

ibm

powervm

hypervisor

cve-2023-30440

sriov

nvd

xforce

denial of service

data corruption

CVSS3

7.9

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

17.7%

JSON

IBM PowerVM Hypervisor FW860.00 through FW860.B3, FW950.00 through FW950.70, FW1010.00 through FW1010.50, FW1020.00 through FW1020.30, and FW1030.00 through FW1030.10 could allow a local attacker with control a partition that has been assigned SRIOV virtual function (VF) to cause a denial of service to a peer partition or arbitrary data corruption. IBM X-Force ID: 253175.

Affected configurations

Nvd

Vulners

Node

ibmpowervm_hypervisorRangefw860–fw860.b3

ibmpowervm_hypervisorRangefw950–fw950.70

ibmpowervm_hypervisorRangefw1010–fw1010.50

ibmpowervm_hypervisorRangefw1020.00–fw1020.30

ibmpowervm_hypervisorRangefw1030.00–fw1030.10

AND

ibmpowervm_hypervisorMatch-

VendorProductVersionCPE
ibmpowervm_hypervisor*cpe:2.3:o:ibm:powervm_hypervisor:*:*:*:*:*:*:*:*
ibmpowervm_hypervisor-cpe:2.3:h:ibm:powervm_hypervisor:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	powervm_hypervisor	*	cpe:2.3:o:ibm:powervm_hypervisor::::::::
ibm	powervm_hypervisor	-	cpe:2.3:h:ibm:powervm_hypervisor:-:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "PowerVM Hypervisor",
    "vendor": "IBM",
    "versions": [
      {
        "lessThanOrEqual": "FW860.B3",
        "status": "affected",
        "version": "FW860.00",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "FW950.70",
        "status": "affected",
        "version": "FW950.00",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "FW1010.50",
        "status": "affected",
        "version": "FW1010.00",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "FW1020.30",
        "status": "affected",
        "version": "FW1020.00",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "FW1030.10",
        "status": "affected",
        "version": "FW1030.00",
        "versionType": "semver"
      }
    ]
  }
]

References

exchange.xforce.ibmcloud.com/vulnerabilities/253175

www.ibm.com/support/pages/node/6997133

CVSS3

7.9

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

17.7%

JSON

Related for CVE-2023-30440