Security Bulletin: This Power System update is being released to address CVE-2023-25683

Summary

The PowerVM Hypervisor could allow an attacker to obtain sensitive information if they gain service access to the HMC

Vulnerability Details

CVEID:CVE-2023-25683
**DESCRIPTION:**IBM PowerVM Hypervisor could allow an attacker to obtain sensitive information if they gain service access to the HMC.
CVSS Base score: 5.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/247592 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

This CVE only affects FSP-based systems. All eBMC-based are unaffected.

Remediation/Fixes

Customers with the products below should install FW950.80 (950_131) or newer to remediate this vulnerability.

Power 9

1. IBM Power System L922 (9008-22L)

2. IBM Power System S922 (9009-22A, 9009-22G)

3. IBM Power System H922 (9223-22H, 9223-22S)

4. IBM Power System S914 (9009-41A, 9009-41G)

5. IBM Power System S924 (9009-42A, 9009-42G)

6. IBM Power System H924 (9223-42H, 9223-42S)

7. IBM Power System E950 (9040-MR9)

8. IBM Power System E980 (9080-M9S)

Customers with the products below should install FW1010.51(1010_163), FW1030.20(1030_058) or newer to remediate this vulnerability.

Power 10

1. IBM Power System E1080 (9080-HEX)

Workarounds and Mitigations

None