Powervm Vios
Monthly
Kernel memory disclosure in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 exposes internal kernel memory to remote unauthenticated attackers via an out-of-bounds read (CWE-125). The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N confirms network-accessible, zero-prerequisite exploitation, though impact is bounded to partial confidentiality loss with no integrity or availability consequences. No public exploit or active exploitation has been identified at time of analysis; IBM has released a patch via advisory at https://www.ibm.com/support/pages/node/7283858.
Denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is achievable by an adjacent-network attacker through a NULL pointer dereference in a network-handling code path. Exploitation requires no authentication but demands high attack complexity, substantially limiting opportunistic or internet-scale attacks. IBM has released a patch via its official support portal; no public exploit code or CISA KEV listing has been identified at time of analysis.
Denial of service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 can be triggered by a remote, unauthenticated attacker exploiting an uninitialized stack pointer (CWE-908), leading to system unavailability. The CVSS vector scores high attack complexity (AC:H), indicating that successful exploitation requires specific conditions or timing rather than a straightforward network request. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog.
Out-of-bounds write in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables remote authenticated attackers to trigger memory corruption leading to partial information disclosure and denial of service. The flaw (CWE-787) requires low-privilege credentials and high attack complexity, placing it at CVSS 4.2 Medium - a realistic but bounded threat profile. No public exploit code or active exploitation is confirmed at time of analysis; IBM has released a vendor patch via advisory at https://www.ibm.com/support/pages/node/7283858.
IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 expose a local denial-of-service condition through improper handling of memory page table configurations (CWE-400), allowing a low-privileged local attacker to exhaust critical kernel resources and crash or hang the system. The CVSS scope-change flag (S:C) is particularly significant in PowerVM VIOS deployments, where a triggered kernel fault in the Virtual I/O Server could cascade to affect co-hosted guest partitions or the hypervisor layer itself. IBM has released a patch via their support portal; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Kernel memory disclosure in IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 exposes internal kernel memory to remote unauthenticated attackers via an out-of-bounds read (CWE-125). The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N confirms network-accessible, zero-prerequisite exploitation, though impact is bounded to partial confidentiality loss with no integrity or availability consequences. No public exploit or active exploitation has been identified at time of analysis; IBM has released a patch via advisory at https://www.ibm.com/support/pages/node/7283858.
Denial of service in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is achievable by an adjacent-network attacker through a NULL pointer dereference in a network-handling code path. Exploitation requires no authentication but demands high attack complexity, substantially limiting opportunistic or internet-scale attacks. IBM has released a patch via its official support portal; no public exploit code or CISA KEV listing has been identified at time of analysis.
Denial of service in IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 can be triggered by a remote, unauthenticated attacker exploiting an uninitialized stack pointer (CWE-908), leading to system unavailability. The CVSS vector scores high attack complexity (AC:H), indicating that successful exploitation requires specific conditions or timing rather than a straightforward network request. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog.
Out-of-bounds write in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 enables remote authenticated attackers to trigger memory corruption leading to partial information disclosure and denial of service. The flaw (CWE-787) requires low-privilege credentials and high attack complexity, placing it at CVSS 4.2 Medium - a realistic but bounded threat profile. No public exploit code or active exploitation is confirmed at time of analysis; IBM has released a vendor patch via advisory at https://www.ibm.com/support/pages/node/7283858.
IBM AIX 7.2 and 7.3, and IBM PowerVM VIOS 4.1 expose a local denial-of-service condition through improper handling of memory page table configurations (CWE-400), allowing a low-privileged local attacker to exhaust critical kernel resources and crash or hang the system. The CVSS scope-change flag (S:C) is particularly significant in PowerVM VIOS deployments, where a triggered kernel fault in the Virtual I/O Server could cascade to affect co-hosted guest partitions or the hypervisor layer itself. IBM has released a patch via their support portal; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.