title: IBM PowerVM gain access
description: An internally discovered vulnerability in PowerVM on IBM Power9 and Power10 systems could allow an attacker with privileged user access to a logical partition to perform an undetected violation of the isolation between logical partitions which could lead to data leakage or the execution of arbitrary code in other logical partitions on the same physical server.  IBM X-Force ID:  252706.
problem types: 264 Permissions, Privileges, Access Controls
affected:
{
defaultStatus: unaffected
product: PowerVM Hypervisor
vendor: IBM
versions:
lessThanOrEqual: FW950.70, status: affected, version: FW950.00, versionType: semver
lessThanOrEqual: FW1010.50, status: affected, version: FW1010.00, versionType: semver
lessThanOrEqual: FW1020.30, status: affected, version: FW1020.00, versionType: semver
lessThanOrEqual: FW1030.10, status: affected, version: FW1030.00, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 9.3
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL