CVE-2023-30438: IBM PowerVM gain access

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-05-17 · updated 2026-06-17

Description

An internally discovered vulnerability in PowerVM on IBM Power9 and Power10 systems could allow an attacker with privileged user access to a logical partition to perform an undetected violation of the isolation between logical partitions which could lead to data leakage or the execution of arbitrary code in other logical partitions on the same physical server. IBM X-Force ID: 252706.

Affected products

IBM PowerVM Hypervisor: from fw950 before fw950.71; from fw1010.00 before fw1010.51; from fw1030.00 before fw1030.11; from fw1020.00 before fw1020.31 — fixed in fw1010.51, fw1020.31, fw1030.11, fw950.71

How to fix

Upgrade to a fixed version: IBM PowerVM Hypervisor fw1010.51, fw1020.31, fw1030.11, fw950.71. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-30438 or the next vulnerability affects your stack