Summary

UPDATED Apr 5 (See ‘Change History’ for full update history. Current update corrected the affected upper fileset levels for VIOS to show that VIOS 3.1.2.50 and 3.1.3.30 are affected. Added iFixes for VIOS 3.1.2.50 and 3.1.3.30. This update applies to the kernel, perfstat, and pfcdd portions of the bulletin.) Vulnerabilities in the AIX kernel and kernel extensions could allow a non-privileged local user to cause a denial of service (CVE-2022-43380, CVE-2022-40233, CVE-2022-39165, CVE-2022-43848, CVE-2022-43849, CVE-2022-39164).

Vulnerability Details

CVEID:CVE-2022-43380
**DESCRIPTION:**IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX NFS kernel extension to cause a denial of service. IBM X-Force ID: 238640.
CVSS Base score: 6.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/238640 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID:CVE-2022-40233
**DESCRIPTION:**IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX TCP/IP kernel extension to cause a denial of service. IBM X-Force ID: 235599.
CVSS Base score: 6.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/235599 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID:CVE-2022-39165
**DESCRIPTION:**IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a non-privileged local user to exploit a vulnerability in CAA to cause a denial of service. IBM X-Force ID: 235183.
CVSS Base score: 6.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/235183 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID:CVE-2022-43848
**DESCRIPTION:**IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX perfstat kernel extension to cause a denial of service. IBM X-Force ID: 239169.
CVSS Base score: 6.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/239169 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID:CVE-2022-43849
**DESCRIPTION:**IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a non-privileged local user to exploit a vulnerability in the AIX pfcdd kernel extension to cause a denial of service. IBM X-Force ID: 239170.
CVSS Base score: 6.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/239170 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID:CVE-2022-39164
**DESCRIPTION:**IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial of service. IBM X-Force ID: 235181.
CVSS Base score: 6.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/235181 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Affected Product(s)	Version(s)
AIX	7.1
AIX	7.2
AIX	7.3
VIOS	3.1

The vulnerabilities in the following filesets are being addressed:

Fileset	Lower Level	Upper Level
bos.cluster.rte	7.1.5.0	7.1.5.39
bos.mp64	7.1.5.0	7.1.5.47
bos.net.nfs.client	7.1.5.0	7.1.5.38
bos.net.tcp.client	7.1.5.0	7.1.5.41
bos.perf.perfstat	7.1.5.0	7.1.5.32
bos.pfcdd.rte	7.1.5.0	7.1.5.34
bos.cluster.rte	7.2.5.0	7.2.5.2
bos.mp64	7.2.5.0	7.2.5.6
bos.net.nfs.client	7.2.5.0	7.2.5.3
bos.net.tcp.client_core	7.2.5.0	7.2.5.4
bos.perf.perfstat	7.2.5.0	7.2.5.0
bos.pfcdd.rte	7.2.5.0	7.2.5.2
bos.cluster.rte	7.2.5.100	7.2.5.102
bos.mp64	7.2.5.100	7.2.5.106
bos.net.nfs.client	7.2.5.100	7.2.5.101
bos.net.tcp.client_core	7.2.5.100	7.2.5.104
bos.perf.perfstat	7.2.5.100	7.2.5.101
bos.pfcdd.rte	7.2.5.100	7.2.5.102
bos.mp64	7.2.5.200	7.2.5.201
bos.pfcdd.rte	7.2.5.200	7.2.5.200
bos.perf.perfstat	7.2.5.200	7.2.5.200
bos.cluster.rte	7.3.0.0	7.3.0.1
bos.mp64	7.3.0.0	7.3.0.4
bos.net.nfs.client	7.3.0.0	7.3.0.1
bos.net.tcp.client_core	7.3.0.0	7.3.0.2
bos.perf.perfstat	7.3.0.0	7.3.0.1
bos.pfcdd.rte	7.3.0.0	7.3.0.2
bos.mp64	7.3.1.0	7.3.1.1
bos.perf.pefstate	7.3.1.0	7.3.1.0

To find out whether the affected filesets are installed on your systems, refer to the lslpp command found in AIX user’s guide.

Example: lslpp -L | grep -i bos.mp64

Remediation/Fixes

A. APARS

IBM has assigned the following APARs to this problem:

For the kernel:

AIX Level	APAR	SP
7.1.5	IJ43967	SP12
7.2.5	IJ43869	SP06
7.3.0	IJ43875	SP04
7.3.1	IJ44594	SP02

VIOS Level	APAR	SP
3.1.2	IJ43995	3.1.2.60
3.1.3	IJ45541	3.1.3.40
3.1.4	IJ43869	3.1.4.20

For the CAA kernel extension:

AIX Level	APAR	SP
7.1.5	IJ43099	SP11
7.2.5	IJ41975	SP06
7.3.0	IJ42938	SP03

VIOS Level	APAR	SP
3.1.2	IJ44115	3.1.2.50
3.1.3	IJ41975	3.1.3.30

For the NFS kernel extension:

AIX Level	APAR	SP
7.1.5	IJ43072	SP11
7.2.5	IJ42159	SP06
7.3.0	IJ43468	SP03

VIOS Level	APAR	SP
3.1.2	IJ43674	3.1.2.50
3.1.3	IJ43314	3.1.3.30

For the TCP/IP kernel extension:

AIX Level	APAR	SP
7.1.5	IJ43098	SP11
7.2.5	IJ41974	SP06
7.3.0	IJ42937	SP03

VIOS Level	APAR	SP
3.1.2	IJ43598	3.1.2.50
3.1.3	IJ43217	3.1.3.30

For the perfstat kernel extension:

AIX Level	APAR	SP
7.1.5	IJ43970	SP12
7.2.5	IJ43876	SP06
7.3.0	IJ43891	SP04
7.3.1	IJ44595	SP02

VIOS Level	APAR	SP
3.1.2	IJ44114	3.1.2.60
3.1.3	IJ43876	3.1.3.40
3.1.4	IJ43876	3.1.4.20

For the pfcdd kernel extension:

AIX Level	APAR	SP
7.1.5	IJ43980	SP12
7.2.5	IJ43877	SP06
7.3.0	IJ43893	SP04

VIOS Level	APAR	SP
3.1.2	IJ46105	3.1.2.60
3.1.3	IJ46068	3.1.3.40
3.1.4	IJ43877	3.1.4.20

Subscribe to the APARs here:

<https://www.ibm.com/support/pages/apar/[APAR> Number]

By subscribing, you will receive periodic email alerting you to the status of the APAR, and a link to download the fix once it becomes available.

B. FIXES

IBM strongly recommends addressing the vulnerability now.

AIX and VIOS fixes are available.

An LPAR system reboot is required to complete the iFix installation, or Live Update may be used on AIX 7.2 and 7.3 to avoid a reboot.

The AIX and VIOS fixes can be downloaded via https from:

<https://aix.software.ibm.com/aix/efixes/security/kernel_fix5.tar&gt;

The link above is to a tar file containing this signed advisory, fix packages, and OpenSSL signatures for each package. The fixes below include prerequisite checking. This will enforce the correct mapping between the fixes and AIX Technology Levels.

For the kernel:

AIX Level	Interim Fix
7.1.5.8	IJ43967m8a.221110.epkg.Z
7.1.5.9	IJ43967m9a.221102.epkg.Z
7.1.5.9	IJ43967m9b.221111.epkg.Z
7.1.5.10	IJ43967mAa.221024.epkg.Z
7.1.5.11	IJ43967sBa.230314.epkg.Z
7.2.5.3	IJ43869m3c.230216.epkg.Z
7.2.5.3	IJ43869m3d.230216.epkg.Z
7.2.5.4	IJ43869m4b.230216.epkg.Z
7.2.5.5	IJ43869m5b.230216.epkg.Z
7.3.0.1	IJ43875m1b.230216.epkg.Z
7.3.0.2	IJ43875m2b.230216.epkg.Z
7.3.0.3	IJ43875s3a.230314.epkg.Z
7.3.1.1	IJ44594m1a.230216.epkg.Z

Please note that the above table refers to AIX TL/SP level as opposed to fileset level, i.e., 7.2.5.4 is AIX 7200-05-04.

NOTE: Multiple iFixes are provided for AIX 7100-05-09 and 7200-05-03.

IJ43967m9a is for AIX 7100-05-09 with bos.mp64 fileset level 7.1.5.45.

IJ43967m9b is for AIX 7100-05-09 with bos.mp64 fileset level 7.1.5.44.

IJ43869m3c is for AIX 7200-05-03 with bos.mp64 fileset level 7.2.5.103.

IJ43869m3d is for AIX 7200-05-03 with bos.mp64 fileset level 7.2.5.101.

Please reference the Affected Products and Version section above for help with checking installed fileset levels.

VIOS Level	Interim Fix
3.1.2.21	IJ43995m2b.221027.epkg.Z
3.1.2.30	IJ43995m2c.221212.epkg.Z
3.1.2.40	IJ43995m2a.221025.epkg.Z
3.1.2.50	IJ43995s5a.230404.epkg.Z
3.1.3.10	IJ43869m3b.221212.epkg.Z
3.1.3.14	IJ43869m3a.221025.epkg.Z
3.1.3.21	IJ43869m4a.221017.epkg.Z
3.1.3.30	IJ45541s3b.230404.epkg.Z
3.1.4.10	IJ43869s5a.221212.epkg.Z

For the CAA kernel extension:

AIX Level	Interim Fix
7.1.5.8	IJ43099m8a.221110.epkg.Z
7.1.5.9	IJ43099m9a.221102.epkg.Z
7.1.5.9	IJ43099m9b.221213.epkg.Z
7.1.5.10	IJ43099sAa.221024.epkg.Z
7.2.5.3	IJ41975m3a.221027.epkg.Z
7.2.5.3	IJ41975m3b.221212.epkg.Z
7.2.5.4	IJ41975s4a.221017.epkg.Z
7.3.0.1	IJ42938m1a.221027.epkg.Z
7.3.0.2	IJ42938s2a.221018.epkg.Z

Please note that the above table refers to AIX TL/SP level as opposed to fileset level, i.e., 7.2.5.4 is AIX 7200-05-04.

NOTE: Multiple iFixes are provided for AIX 7100-05-09 and 7200-05-03.

IJ43099m9a is for AIX 7100-05-09 with bos.cluster.rte fileset level 7.1.5.38.

IJ43099m9b is for AIX 7100-05-09 with bos.cluster.rte fileset level 7.1.5.37.

IJ41975m3a is for AIX 7200-05-03 with bos.cluster.rte fileset level 7.2.5.101.

IJ41975m3b is for AIX 7200-05-03 with bos.cluster.rte fileset level 7.2.5.100.

VIOS Level	Interim Fix
3.1.2.21	IJ44115m2a.221102.epkg.Z
3.1.2.30	IJ44115m2a.221102.epkg.Z
3.1.2.40	IJ44115m2b.221213.epkg.Z
3.1.3.10	IJ41975m3b.221212.epkg.Z
3.1.3.14	IJ41975m3a.221027.epkg.Z
3.1.3.21	IJ41975s4a.221017.epkg.Z

For the NFS kernel extension:

AIX Level	Interim Fix
7.1.5.8	IJ43072s8a.221110.epkg.Z
7.1.5.9	IJ43072sAa.221024.epkg.Z
7.1.5.10	IJ43072sAa.221024.epkg.Z
7.2.5.3	IJ42159s3a.221025.epkg.Z
7.2.5.3	IJ42159s3b.221213.epkg.Z
7.2.5.4	IJ42159s4a.221017.epkg.Z
7.3.0.1	IJ43468s1a.221025.epkg.Z
7.3.0.2	IJ43468s2a.221017.epkg.Z

Please note that the above table refers to AIX TL/SP level as opposed to fileset level, i.e., 7.2.5.4 is AIX 7200-05-04.

NOTE: Multiple iFixes are provided for AIX 7200-05-03.

IJ42159s3a is for AIX 7200-05-03 with bos.adt.include fileset level 7.2.5.102.

IJ42159s3b is for AIX 7200-05-03 with bos.adt.include fileset level 7.2.5.101.

VIOS Level	Interim Fix
3.1.2.21	IJ43674s2b.221027.epkg.Z
3.1.2.30	IJ43674s2c.221213.epkg.Z
3.1.2.40	IJ43674s2c.221213.epkg.Z
3.1.3.10	IJ42159s3b.221213.epkg.Z
3.1.3.14	IJ42159s3a.221025.epkg.Z
3.1.3.21	IJ42159s4a.221017.epkg.Z

For the TCP/IP kernel extension:

AIX Level	Interim Fix
7.1.5.8	IJ43098s8a.221110.epkg.Z
7.1.5.9	IJ43098s9a.221102.epkg.Z
7.1.5.9	IJ43098s9b.221213.epkg.Z
7.1.5.10	IJ43098sAa.221024.epkg.Z
7.2.5.3	IJ41974s3a.221025.epkg.Z
7.2.5.3	IJ41974s3b.221213.epkg.Z
7.2.5.4	IJ41974s4a.221017.epkg.Z
7.3.0.1	IJ42937s1a.221027.epkg.Z
7.3.0.2	IJ42937s2a.221018.epkg.Z

Please note that the above table refers to AIX TL/SP level as opposed to fileset level, i.e., 7.2.5.4 is AIX 7200-05-04.

NOTE: Multiple iFixes are provided for AIX 7100-05-09 and 7200-05-03.

IJ43098s9a is for AIX 7100-05-09 with bos.net.tcp.client fileset level 7.1.5.40.

IJ43098s9b is for AIX 7100-05-09 with bos.net.tcp.client fileset level 7.1.5.39.

IJ41974s3a is for AIX 7200-05-03 with bos.net.tcp.client_core fileset level 7.2.5.102.

IJ41974s3b is for AIX 7200-05-03 with bos.net.tcp.client_core fileset level 7.2.5.101.

VIOS Level	Interim Fix
3.1.2.21	IJ43598s2b.221027.epkg.Z
3.1.2.30	IJ43598s2d.221213.epkg.Z
3.1.2.40	IJ43598s2c.221213.epkg.Z
3.1.3.10	IJ41974s3b.221213.epkg.Z
3.1.3.14	IJ41974s3a.221025.epkg.Z
3.1.3.21	IJ41974s4a.221017.epkg.Z

For the perfstat kernel extension:

AIX Level	Interim Fix
7.1.5.8	IJ43970sAa.221024.epkg.Z
7.1.5.9	IJ43970sAa.221024.epkg.Z
7.1.5.10	IJ43970sAa.221024.epkg.Z
7.1.5.11	IJ43970sAa.221024.epkg.Z
7.2.5.3	IJ43876s3a.221025.epkg.Z
7.2.5.3	IJ43876s3b.221213.epkg.Z
7.2.5.4	IJ43876s4a.221017.epkg.Z
7.2.5.5	IJ43876s5a.221212.epkg.Z
7.3.0.1	IJ43891s2a.221018.epkg.Z
7.3.0.2	IJ43891s2a.221018.epkg.Z
7.3.0.3	IJ43891s3a.230314.epkg.Z
7.3.1.1	IJ44595s1a.221212.epkg.Z

Please note that the above table refers to AIX TL/SP level as opposed to fileset level, i.e., 7.2.5.4 is AIX 7200-05-04.

NOTE: Multiple iFixes are provided for AIX 7200-05-03.

IJ43876s3a is for AIX 7200-05-03 with bos.perf.perfstat fileset level 7.2.5.101.

IJ43876s3b is for AIX 7200-05-03 with bos.perf.perfstat fileset level 7.2.5.100.

VIOS Level	Interim Fix
3.1.2.21	IJ44114s2a.221102.epkg.Z
3.1.2.30	IJ44114s2a.221102.epkg.Z
3.1.2.40	IJ44114s2a.221102.epkg.Z
3.1.2.50	IJ44114s2a.221102.epkg.Z
3.1.3.10	IJ43876s3b.221213.epkg.Z
3.1.3.14	IJ43876s3a.221025.epkg.Z
3.1.3.21	IJ43876s4a.221017.epkg.Z
3.1.3.30	IJ43876s4a.221017.epkg.Z
3.1.4.10	IJ43876s5a.221212.epkg.Z

For the pfcdd kernel extension:

AIX Level	Interim Fix
7.1.5.8	IJ43980sAa.221024.epkg.Z
7.1.5.9	IJ43980sAa.221024.epkg.Z
7.1.5.10	IJ43980sAa.221024.epkg.Z
7.1.5.11	IJ43980sBa.230314.epkg.Z
7.2.5.3	IJ43877s3a.221025.epkg.Z
7.2.5.4	IJ43877s4a.221017.epkg.Z
7.2.5.5	IJ43877s5a.230123.epkg.Z
7.3.0.1	IJ43893s1a.221027.epkg.Z
7.3.0.2	IJ43893s2a.221018.epkg.Z
7.3.0.3	IJ43893s3a.230314.epkg.Z

Please note that the above table refers to AIX TL/SP level as opposed to fileset level, i.e., 7.2.5.4 is AIX 7200-05-04.

VIOS Level	Interim Fix
3.1.2.21	IJ44116s2a.221102.epkg.Z
3.1.2.30	IJ44116s2a.221102.epkg.Z
3.1.2.40	IJ44116s2a.221102.epkg.Z
3.1.2.50	IJ46105s5a.230404.epkg.Z
3.1.3.10	IJ43877s3a.221025.epkg.Z
3.1.3.14	IJ43877s3a.221025.epkg.Z
3.1.3.21	IJ43877s4a.221017.epkg.Z
3.1.3.30	IJ46068s3a.230404.epkg.Z
3.1.4.10	IJ43877s5a.230123.epkg.Z

The fixes are cumulative and address previously issued AIX/VIOS kernel security bulletins with respect to SP and TL, which includes:

<https://aix.software.ibm.com/aix/efixes/security/kernel_advisory4.asc&gt;

<https://www.ibm.com/support/pages/node/6619721&gt;

<https://aix.software.ibm.com/aix/efixes/security/kernel_advisory3.asc&gt;

<https://www.ibm.com/support/pages/node/6558948&gt;

<https://aix.software.ibm.com/aix/efixes/security/kernel_advisory2.asc&gt;

<https://www.ibm.com/support/pages/node/6483875&gt;

<https://aix.software.ibm.com/aix/efixes/security/trace_advisory.asc&gt;

<https://www.ibm.com/support/pages/node/6464369&gt;

To extract the fixes from the tar file:

tar xvf kernel_fix5.tar

cd kernel_fix5

Verify you have retrieved the fixes intact:

The checksums below were generated using the

“openssl dgst -sha256 [filename]” command as the following:

openssl dgst -sha256	filename
5f14f1ce6115aaea99abc509e8f9c29d66f449e28cbdff957a78f98a0d2c1319	IJ41974s3a.221025.epkg.Z
f461d5ac0225674d0b5fd2ce0ea1314c413f73d941e3cab1df2a8e907e479c81	IJ41974s3b.221213.epkg.Z
7353aec35438c207ecd34e9efd8773f8d2cf623ff3aaf1c9b21a8c6cc6389ba3	IJ41974s4a.221017.epkg.Z
ac6aac0b2364a1dccf99133869bcf5962a30d14c44abd72985d58b070b3e7743	IJ41975m3a.221027.epkg.Z
9320a9ecad0ed683f838f484a512de20f88d281940b63e13f334dbac0e023dd1	IJ41975m3b.221212.epkg.Z
53ed081ce54eaf4a278761c7b80b72e28643d3f07a8ab54b2977652b1cfa9410	IJ41975s4a.221017.epkg.Z
dd932b380464cc89938b42bf845d08d1aee3ab6a50ca7bc57292ddda34b849be	IJ42159s3a.221025.epkg.Z
0ad3ac0184e19719156e0b1c4af6f97501a64bb3a26543ddbda27cc975c8ad76	IJ42159s3b.221213.epkg.Z
ce81ba4ce3db613bb6635ff1496c4b65a0a09c24f8f6d0dd96606bc48b420cf5	IJ42159s4a.221017.epkg.Z
4b3d56260e136ad0b4484db0d2b4dd3924a97c5bc839f80d7ea4c21c42eb3840	IJ42937s1a.221027.epkg.Z
7081ec434fa5ff2c976f935aa6b51f4f51f6641dfd6132640c73dbaea7a6c1cf	IJ42937s2a.221018.epkg.Z
6f6d8cf2b6a52f409fa29dc72ef2ada536ea67dc907769c384f88fa60a39b622	IJ42938m1a.221027.epkg.Z
581acd69242d1f86779590e5ed0734de72b6f2452a6b499dceaa8c2b4eadad7d	IJ42938s2a.221018.epkg.Z
7d5e82ac6027d9fb1b4546a1de78220af56e77b87d2b7cb744d544aa64b20c62	IJ43072s8a.221110.epkg.Z
dc281b603fe5b7d7aa79e061a60e01f7a39eaa30233b545ee760798208ac6adf	IJ43072sAa.221024.epkg.Z
c6701b36ff490220433aa81466f5a60e182ba2559e07df7fdbd986329e187e1a	IJ43098s8a.221110.epkg.Z
1aeded2670910f1aeb2c07cef08d2d6afce788e8de58794db1e93567b5dbed77	IJ43098s9a.221102.epkg.Z
3ac4dd5bc1f3688a2b73e0da29c64cbafff025e7c1a05b5008752d3c8d8b5835	IJ43098s9b.221213.epkg.Z
470310e914d030445412685cd06897804a547b6f26f5b12499c9c3012906083f	IJ43098sAa.221024.epkg.Z
dad650e7a3f3ac27cc4ca0c3df9bbb1b0dc60ca449f0127398f7c2686c4fb67f	IJ43099m8a.221110.epkg.Z
a5eef69f5ad7999aac0090c6f44f2b830ed5fe704a03650c78834300433fefd6	IJ43099m9a.221102.epkg.Z
0690a7f9c117bb685540bda389f4f4a99020a45927a5481e72256f1912b2b5a0	IJ43099m9b.221213.epkg.Z
643694ee61b99af1d32f3723c056480c752d70d2f4c824f2e02cacf1489966f4	IJ43099sAa.221024.epkg.Z
7e4791c2b339034a6e20fb2d14968a2570795e0c292a4693e79b609d7f947a49	IJ43468s1a.221025.epkg.Z
87ea6d1ce409ae51ad7e10007bf52d0531e58d921553ada09b7da4d24fbdc6ef	IJ43468s2a.221017.epkg.Z
36fb6866347a3b4499d752edfdcade8fedd683d0514bb45b356fb69b0e77243a	IJ43598s2b.221027.epkg.Z
49d5cbd9ba461b2477eade7ee16964437fc85b32ea285f747e9286f7d3c32d35	IJ43598s2c.221213.epkg.Z
fba350df9177bab36d6f869a7debc8b5d29c8a6b3a3a7216a1dd3ac50d0179b9	IJ43598s2d.221213.epkg.Z
c423961037b20a89416d095b0385fcdbc69c9fb51b005c342945d14e5aab9294	IJ43674s2b.221027.epkg.Z
e61c7a4e495cf2da86d239f84c275f52fac696880142c603477f038cdfc55df5	IJ43674s2c.221213.epkg.Z
158e99123e6a6eb8909943a3438c032ba3f06248e6da4c6402e9efd3ce3900aa	IJ43869m3a.221025.epkg.Z
7bc058cb39721fea6c11e79a45e5e2cf8501ea762169dba214be9849ddb727d8	IJ43869m3b.221212.epkg.Z
c416914cd934f8235c9c39937d70437ab1193533142412f9726dae10cc1ff6b4	IJ43869m4a.221017.epkg.Z
2cea6bd4f5e87074bb7e4999e53cc6105cbb060c0e43d65e7a00ace071fea97f	IJ43869s5a.221212.epkg.Z
e8e91cb5a7446dd7cdeafd6f22ebd007bfcb5df7151fc1cc02888ad7859a1ba4	IJ43875m1a.221025.epkg.Z
33b719eb2216776a0cafca012771db3dc1cdf7676dbb9a8d3611e24795d1d7bb	IJ43875m2a.221017.epkg.Z
cb9e693c29e1d2f33c3a304779491030fb9233a3c5a60dc116a8acef3cc349ce	IJ43876s3a.221025.epkg.Z
5f44726c3402cacf73de3e91b5b518895e1e1a0d47141855319e48dd40d81d17	IJ43876s3b.221213.epkg.Z
e7ac8b7326ea273723968938f7405c0b105ec1413cb3c4ca6db54d91e13977e3	IJ43876s4a.221017.epkg.Z
d4815878bc65ba7524718d0b75f211f7bf5e8c97ed644894843309fdc312cdaf	IJ43876s5a.221212.epkg.Z
56f4a15bd4b5c33642207323dc1d21262f7558ad7879d5fc3f8c6f5fdf020ca1	IJ43877s3a.221025.epkg.Z
466c3b4a3238e68226ff7886771ec37d0787a964b8a27dba5d01f3a51c610af4	IJ43877s4a.221017.epkg.Z
68e3dadd864733d1edd5c59228fb0d6418829689a3395396f2237f9782093110	IJ43891s2a.221018.epkg.Z
714238ea24f04de93378bf879d1ab1b1dc1592a73732bd345915b16849940c9d	IJ43893s1a.221027.epkg.Z
c3b40b12d60119453b32c1b0cd73d560c7b7755703c62bff138d986dd78c3c4c	IJ43893s2a.221018.epkg.Z
3342e50f48f0c995d4ab0ed852cbc3f782b05be4938bffddd06bdcd206fe5b13	IJ43967m8a.221110.epkg.Z
307f93cee2e4767d2cedec1c705acfbd099d7b8b32c8853bcfa18ff762a6fc1f	IJ43967m9a.221102.epkg.Z
952d2e4b8888ea3beca7fbe6841191fdd58675f3640e4018d0f9de430016c504	IJ43967m9b.221111.epkg.Z
f819756d2d2ab6094ae4744babbf9cc10d47e04484973dac44a736029e741e21	IJ43967mAa.221024.epkg.Z
e7f8b39a6df86429f9859e7e6364a37b73de53952fd8cb69a570ab6397196055	IJ43970sAa.221024.epkg.Z
51589ea00f8e6574d563e71ae33604d7b7397391482165495aa27d867926354c	IJ43980sAa.221024.epkg.Z
64a961365a68e435e35313e7bd5fda2b2f1d93c84a266e1dddfe792b3b43efdd	IJ43995m2a.221025.epkg.Z
20f41357e75da7a386de8990c92a781c32de92fbfaa6bc56eda09685dcf979ea	IJ43995m2b.221027.epkg.Z
541cee83f622844dd0c6ca50515e3d41e6a6727c7a1264ca67ca696c8c7984d1	IJ43995m2c.221212.epkg.Z
c89483dc79d4132f32bc41211696616c4707c253a4c452a2829b122d1b19db06	IJ44114s2a.221102.epkg.Z
9cb895991f8a94f66ef77985cacec5a5f7018f97dd2567f403cfb5aeb4d43f73	IJ44115m2a.221102.epkg.Z
7c5490016562d664d5d7a68ef2669407053ccb2175f8b0f13a3dd1197e1287d0	IJ44115m2b.221213.epkg.Z
82caf3050ae1ea2120e3fc6aec0e4387f51c7e8b1b28993d799dc4c7bdd066a2	IJ44116s2a.221102.epkg.Z
9b8f2f3a5a17596b2388e01fb4006a937d363f3b044b27ff817081b0d4b2c915	IJ44594s1a.221212.epkg.Z
1af43848b2d615d9a341b5b9d79a36d6ce61b3f7911808c0a07e5a14189cd33e	IJ44595s1a.221212.epkg.Z
ebe3dc4484195bdab109a378559e763b0bbf5841cd9f2c2c8e14ecd3ef9d0e5e	IJ43877s5a.230123.epkg.Z
3ff36152cb41f03cfcd53ae3d62abef462d8e4413580fbb3791f1e1bd97b42d0	IJ43869m3c.230216.epkg.Z
425e99709eb5d2bd5e3bf5d050756ae449955a3003dd80dbdae82fb7de98dce9	IJ43869m3d.230216.epkg.Z
4a70d24d07bd8c47933dff26d8acbdbdf9683cc5cb45cfb9561fc255af3cb126	IJ43869m4b.230216.epkg.Z
22324ac88e237ae509721d0491f25fdfc6fd52a1d7db850559dee786e18b371e	IJ43869m5b.230216.epkg.Z
c4d645f2037cad14c73f1ad91276dda4afecae0bede46686f6c76381bb026fb9	IJ43875m1b.230216.epkg.Z
6e7b81be73863b958f6ac788774d2264d281770f70c23b397c214ec719d1013f	IJ43875m2b.230216.epkg.Z
d5bee8d3d0606132b59efae3997c9a6c76462396109eb83aeb23e35fa9dedf9c	IJ44594m1a.230216.epkg.Z
4e13e56fefcda5b42bc1cc5ac5bb6a3ce6d5381820b6cc04d5e4a2ac7ba2b5b7	IJ43875s3a.230314.epkg.Z
f42aa6ccfc40903241dc0a9cdc6c16afb9006e50064402ff8c89bcbf52075752	IJ43891s3a.230314.epkg.Z
59abc2a3a1ac0f9971754c1a1471aa06a5a5df50c84f6275f93fbad037f12e5d	IJ43893s3a.230314.epkg.Z
59b3ffdb67890f448a30f90399d4beec89d19e190d96470813d2b0297e3a7f84	IJ43967sBa.230314.epkg.Z
fdfaced64f43867e83fc0dbcf9a1599654378c32dcbea44eab73be019be51425	IJ43980sBa.230314.epkg.Z
f2f3e7983d59726b277dff0776fe4f2a2299c59064ff65a85cca218d9b28e88a	IJ43995s5a.230404.epkg.Z
4c10040cb56e6316e468d9ee20aa70e09ba61d0594374888e3ebcbf4c83e73ea	IJ45541s3b.230404.epkg.Z
f52ef61837f06719e567ed1b181635fed35bbebf7c31140d5c05ed5dfa63371c	IJ46068s3a.230404.epkg.Z
504068cd84fe4431d7ce3e78bb93ee79a071447b753472111aec3f5e4d445c38	IJ46105s5a.230404.epkg.Z

These sums should match exactly. The OpenSSL signatures in the tar file and on this advisory can also be used to verify the integrity of the fixes. If the sums or signatures cannot be confirmed, contact IBM Support at <http://ibm.com/support/&gt; and describe the discrepancy.

openssl dgst -sha256 -verify [pubkey_file] -signature [advisory_file].sig [advisory_file]

openssl dgst -sha256 -verify [pubkey_file] -signature [ifix_file].sig [ifix_file]

Published advisory OpenSSL signature file location:

<https://aix.software.ibm.com/aix/efixes/security/kernel_advisory5.asc.sig&gt;

C. FIX AND INTERIM FIX INSTALLATION

An LPAR system reboot is required to complete the iFix installation, or Live Update may be used on AIX 7.2 and 7.3 to avoid a reboot.

If possible, it is recommended that a mksysb backup of the system be created. Verify it is both bootable and readable before proceeding.

To preview a fix installation:

installp -a -d fix_name -p all # where fix_name is the name of the

fix package being previewed.

To install a fix package:

installp -a -d fix_name -X all # where fix_name is the name of the

fix package being installed.

Interim fixes have had limited functional and regression testing but not the full regression testing that takes place for Service Packs; however, IBM does fully support them.

Interim fix management documentation can be found at:

<http://www14.software.ibm.com/webapp/set2/sas/f/aix.efixmgmt/home.html&gt;

To preview an interim fix installation:

emgr -e ipkg_name -p # where ipkg_name is the name of the

interim fix package being previewed.

To install an interim fix package:

emgr -e ipkg_name -X # where ipkg_name is the name of the

interim fix package being installed.

Workarounds and Mitigations

None