Security Bulletin: This Power System update is being released to address CVE-2023-46183

Summary

A vulnerability was identifed where sensitive partition data controlled by PowerVM may be accessible to a system administrator.

Vulnerability Details

CVEID:CVE-2023-46183
**DESCRIPTION:**IBM PowerVM Hypervisor could allow a system administrator to obtain sensitive partition information.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/269695 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

Customers with the products below should install FW950.A0(950_145) or newer to remediate this vulnerability.

Power 9

1. IBM Power System L922 (9008-22L)

2. IBM Power System S922 (9009-22A, 9009-22G)

3. IBM Power System H922 (9223-22H, 9223-22S)

4. IBM Power System S914 (9009-41A, 9009-41G)

5. IBM Power System S924 (9009-42A, 9009-42G)

6. IBM Power System H924 (9223-42H, 9223-42S)

7. IBM Power System E950 (9040-MR9)

8. IBM Power System E980 (9080-M9S)

Customers with the products below should install FW1030.40(1030_066), FW1050.00(1050_43) or newer to remediate this vulnerability.

Power 10

1. IBM Power System E1080 (9080-HEX)

Customers with the products below should install FW1020.50(1020_112), FW1030.40(1030_075), FW1050.00(1050_52) or newer to remediate this vulnerability.

Power 10

1. IBM Power System S1022 (9105-22A)

2. IBM Power System S1024 (9105-42A)

3. IBM Power System S1022s (9105-22B)

4. IBM Power System S1014 (9105-41B)

5. IBM Power System L1022 (9786-22H)

6. IBM Power System L1024 (9786-42H)

7. IBM Power System E1050 (9043-MRX)

Workarounds and Mitigations

None