Lucene search

IbmCVE-2021-20505

HistoryJul 29, 2021 - 12:15 p.m.

CVE-2021-20505

2021-07-2912:15:07

ibm

web.nvd.nist.gov

cve-2021-20505

powervm

lpm

encryption key

compromise

migration traffic

ibm x-force

nvd

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:N/A:N

CVSS3

4.4

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

AI Score

4.6

Confidence

High

EPSS

Percentile

9.7%

JSON

The PowerVM Logical Partition Mobility(LPM) (PowerVM Hypervisor FW920, FW930, FW940, and FW950) encryption key exchange protocol can be compromised. If an attacker has the ability to capture encrypted LPM network traffic and is able to gain service access to the FSP they can use this information to perform a series of PowerVM service procedures to decrypt the captured migration traffic IBM X-Force ID: 198232

Affected configurations

Nvd

Vulners

Node

ibmpowervm_hypervisorMatchfw920

ibmpowervm_hypervisorMatchfw930

ibmpowervm_hypervisorMatchfw940

ibmpowervm_hypervisorMatchfw950

VendorProductVersionCPE
ibmpowervm_hypervisorfw920cpe:2.3:o:ibm:powervm_hypervisor:fw920:*:*:*:*:*:*:*
ibmpowervm_hypervisorfw930cpe:2.3:o:ibm:powervm_hypervisor:fw930:*:*:*:*:*:*:*
ibmpowervm_hypervisorfw940cpe:2.3:o:ibm:powervm_hypervisor:fw940:*:*:*:*:*:*:*
ibmpowervm_hypervisorfw950cpe:2.3:o:ibm:powervm_hypervisor:fw950:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	powervm_hypervisor	fw920	cpe:2.3:o:ibm:powervm_hypervisor:fw920:::::::*
ibm	powervm_hypervisor	fw930	cpe:2.3:o:ibm:powervm_hypervisor:fw930:::::::*
ibm	powervm_hypervisor	fw940	cpe:2.3:o:ibm:powervm_hypervisor:fw940:::::::*
ibm	powervm_hypervisor	fw950	cpe:2.3:o:ibm:powervm_hypervisor:fw950:::::::*

CNA Affected

[
  {
    "product": "PowerVM Hypervisor",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "FW920"
      },
      {
        "status": "affected",
        "version": "FW930"
      },
      {
        "status": "affected",
        "version": "FW940"
      },
      {
        "status": "affected",
        "version": "FW950"
      }
    ]
  }
]

References

exchange.xforce.ibmcloud.com/vulnerabilities/198232

www.ibm.com/support/pages/node/6475619

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:N/A:N

CVSS3

4.4

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

AI Score

4.6

Confidence

High

EPSS

Percentile

9.7%

JSON

Related for CVE-2021-20505