Vulnerability in IBM Powervm Hypervisor
CVE-2021-20505
The PowerVM Logical Partition Mobility(LPM) (PowerVM Hypervisor FW920, FW930, FW940, and FW950) encryption key exchange protocol can be compromised. If an attacker has the ability to capture encrypted LPM network traffic and is able to gain service access to the FSP they can use this information to perform a series of PowerVM service procedures to decrypt the captured migration traffic IBM X-Force ID: 198232
EPSS: 0.005 (43.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.4 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Ibm Powervm Hypervisor — versions FW920, FW930, FW940
- Ibm Powervm_hypervisor — versions fw920, fw930, fw940
References
- psirt@us.ibm.com (x_refsource_CONFIRM, Vendor Advisory)
- psirt@us.ibm.com (VDB Entry, vdb-entry, Vendor Advisory, x_refsource_XF)
Frequently asked questions
- What is CVE-2021-20505?
- CVE-2021-20505 is a medium-severity vulnerability in IBM Powervm Hypervisor. CVSS score: 4.4/10. Published 2021-07-29.
- How severe is CVE-2021-20505?
- Medium severity. CVSS v3 base score is 4.4 out of 10.