Lucene search

K
ibmIBMC8058EE2D98E4E3A2B41A83E031B9A6C3266947F454144446221EF58E526C98F
HistoryMar 31, 2023 - 4:13 p.m.

Security Bulletin: Multiple vulnerabilities in VMware ESXi affect IBM Cloud Pak System

2023-03-3116:13:36
www.ibm.com
25
vmware esxi
ibm cloud pak system
vulnerabilities
intel processors
xen
cve-2022-28693
cve-2022-29901
cve-2022-23816
cve-2022-23825
information leak
esxi image update
cloud pak system 2.3.3.6

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

EPSS

0.001

Percentile

31.1%

Summary

Vulnerabilities identified in VMware ESXi bundled with Cloud Pak System. Cloud Pak Systen has addressed vulnerabilities.

Vulnerability Details

CVEID:CVE-2022-28693
**DESCRIPTION:**Intel Processors could allow a local authenticated attacker to obtain sensitive information, caused by unprotected alternative channel of return branch target prediction. An attacker could exploit this vulnerability to obtain sensitive information.
CVSS Base score: 4.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/230959 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)

CVEID:CVE-2022-29901
**DESCRIPTION:**Intel Processors could allow a local authenticated attacker to obtain sensitive information, caused by the non-transparent sharing of branch predictor targets between contexts attacks. An attacker could exploit this vulnerability to obtain sensitive information.
CVSS Base score: 4.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/230960 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)

CVEID:CVE-2022-23816
**DESCRIPTION:**Xen could allow a local authenticated attacker to obtain sensitive information, caused by a Branch Type Confusion vulnerability due to the Intel and AMD processors it utilizes. An attacker could exploit this vulnerability to leak information stored in physical memory about the hypervisor or other virtual machines that reside on the same ESXi host.
CVSS Base score: 5.6
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/230961 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N)

CVEID:CVE-2022-23825
**DESCRIPTION:**Xen could allow a local authenticated attacker to obtain sensitive information, caused by a Branch Type Confusion vulnerability due to the Intel and AMD processors it utilizes. An attacker could exploit this vulnerability to leak information stored in physical memory about the hypervisor or other virtual machines that reside on the same ESXi host.
CVSS Base score: 5.6
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/230962 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N)

Affected Products and Versions

Affected Product(s) Version(s)
IBM Cloud Pak System 2.3.3.5 (Intel)
IBM Cloud Pak System Software Suite 2.3.3.0
IBM Cloud Pak System 2.3

Remediation/Fixes

For Unsupported versions/release/platform of the product IBM recommends upgrade to supported version/release/platform of the product.

In response to vulnerabilities found in VMware ESXi, Cloud Pak System provides new ESXi Image update to ESXi 6.7 P08 ESXi670-202210001 with Cloud Pak System 2.3.3.6.

For IBM Cloud Pak System V2.3.0.1, v2.3.3.0, v.2.3.3.1, v.2.3.3.2, v.2.3.3.3, v2.3.3.3 iFix 1, v2.3.3.4, v2.3.3.5

Upgrade to Cloud Pak System v2.3.3.6 available at FixCentral.

Information on upgrading can be found here: http://www.ibm.com/support/docview.wss?uid=ibm10887959.

Workarounds and Mitigations

None

Affected configurations

Vulners
Node
ibmcloud_pak_systemMatch2.3

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

EPSS

0.001

Percentile

31.1%