CVE-2023-30438 : An internally discovered vulnerability in PowerVM on IBM Power9 and Power10 systems could allow an attacker with privile

An internally discovered vulnerability in PowerVM on IBM Power9 and Power10 systems could allow an attacker with privileged user access to a logical partition to perform an undetected violation of the isolation between logical partitions which could lead to data leakage or the execution of arbitrary code in other logical partitions on the same physical server. IBM X-Force ID: 252706.

Published 2023-05-17 13:15:09

Updated 2023-05-25 19:35:11

Source IBM Corporation

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2023-30438

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 6 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-30438

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
8.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	2.0	6.0	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: High
9.3	CRITICAL	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	2.5	6.0	IBM Corporation
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: High

References for CVE-2023-30438

Products affected by CVE-2023-30438

IBM » Powervm Hypervisor
Versions from including (>=) fw1030.00 and before (<) fw1030.11
cpe:2.3:o:ibm:powervm_hypervisor:*:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Power System E1080 » Version: N/A
IBM » Powervm Hypervisor
Versions from including (>=) fw1010.00 and before (<) fw1010.51
cpe:2.3:o:ibm:powervm_hypervisor:*:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Power System E1080 » Version: N/A
IBM » Powervm Hypervisor
Versions from including (>=) fw1020.00 and before (<) fw1020.31
cpe:2.3:o:ibm:powervm_hypervisor:*:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Power System E1050 » Version: N/A
When used together with: IBM » Power System L1022 » Version: N/A
When used together with: IBM » Power System L1024 » Version: N/A
When used together with: IBM » Power System S1014 » Version: N/A
When used together with: IBM » Power System S1022 » Version: N/A
When used together with: IBM » Power System S1022s » Version: N/A
When used together with: IBM » Power System S1024 » Version: N/A
IBM » Powervm Hypervisor
Versions from including (>=) fw950 and before (<) fw950.71
cpe:2.3:o:ibm:powervm_hypervisor:*:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » Power System E950 » Version: N/A
When used together with: IBM » Power System E980 » Version: N/A
When used together with: IBM » Power System H922 » Version: N/A
When used together with: IBM » Power System H924 » Version: N/A
When used together with: IBM » Power System L922 » Version: N/A
When used together with: IBM » Power System S914 » Version: N/A
When used together with: IBM » Power System S922 » Version: N/A
When used together with: IBM » Power System S924 » Version: N/A

Vulnerability Details : CVE-2023-30438

Exploit prediction scoring system (EPSS) score for CVE-2023-30438

CVSS scores for CVE-2023-30438

References for CVE-2023-30438

Products affected by CVE-2023-30438