6.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
2.1 Low
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:L/Au:N/C:P/I:N/A:N
0.001 Low
EPSS
Percentile
33.1%
Vulnerabilities identified in VMware ESXi bundled with Cloud Pak System. Cloud Pak Systen has addressed vulnerabilities.
CVEID:CVE-2022-28693
**DESCRIPTION:**Intel Processors could allow a local authenticated attacker to obtain sensitive information, caused by unprotected alternative channel of return branch target prediction. An attacker could exploit this vulnerability to obtain sensitive information.
CVSS Base score: 4.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/230959 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVEID:CVE-2022-29901
**DESCRIPTION:**Intel Processors could allow a local authenticated attacker to obtain sensitive information, caused by the non-transparent sharing of branch predictor targets between contexts attacks. An attacker could exploit this vulnerability to obtain sensitive information.
CVSS Base score: 4.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/230960 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
CVEID:CVE-2022-23816
**DESCRIPTION:**Xen could allow a local authenticated attacker to obtain sensitive information, caused by a Branch Type Confusion vulnerability due to the Intel and AMD processors it utilizes. An attacker could exploit this vulnerability to leak information stored in physical memory about the hypervisor or other virtual machines that reside on the same ESXi host.
CVSS Base score: 5.6
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/230961 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N)
CVEID:CVE-2022-23825
**DESCRIPTION:**Xen could allow a local authenticated attacker to obtain sensitive information, caused by a Branch Type Confusion vulnerability due to the Intel and AMD processors it utilizes. An attacker could exploit this vulnerability to leak information stored in physical memory about the hypervisor or other virtual machines that reside on the same ESXi host.
CVSS Base score: 5.6
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/230962 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N)
Affected Product(s) | Version(s) |
---|---|
IBM Cloud Pak System | 2.3.3.5 (Intel) |
IBM Cloud Pak System Software Suite | 2.3.3.0 |
IBM Cloud Pak System | 2.3 |
For Unsupported versions/release/platform of the product IBM recommends upgrade to supported version/release/platform of the product.
In response to vulnerabilities found in VMware ESXi, Cloud Pak System provides new ESXi Image update to ESXi 6.7 P08 ESXi670-202210001 with Cloud Pak System 2.3.3.6.
For IBM Cloud Pak System V2.3.0.1, v2.3.3.0, v.2.3.3.1, v.2.3.3.2, v.2.3.3.3, v2.3.3.3 iFix 1, v2.3.3.4, v2.3.3.5
Upgrade to Cloud Pak System v2.3.3.6 available at FixCentral.
Information on upgrading can be found here: http://www.ibm.com/support/docview.wss?uid=ibm10887959.
None
CPE | Name | Operator | Version |
---|---|---|---|
ibm cloud pak system software | eq | 2.3 |
6.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
2.1 Low
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:L/Au:N/C:P/I:N/A:N
0.001 Low
EPSS
Percentile
33.1%