CVE-2021-20505 MEDIUM

CVE-2021-20505

Vendor Ibm
Product PowerVM Hypervisor
Published July 29, 2021
Last update September 16, 2024

CVSS base score

4.4/10
Attack vector Network
Attack complexity High
Privileges required High
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.0/UI:N/S:U/I:N/C:H/AC:H/PR:H/AV:N/A:N/RC:C/RL:O/E:U

What the vulnerability does

01Description

The PowerVM Logical Partition Mobility(LPM) (PowerVM Hypervisor FW920, FW930, FW940, and FW950) encryption key exchange protocol can be compromised. If an attacker has the ability to capture encrypted LPM network traffic and is able to gain service access to the FSP they can use this information to perform a series of PowerVM service procedures to decrypt the captured migration traffic IBM X-Force ID: 198232

Key dates

02Disclosure timeline

July 29, 2021 CVE published
September 16, 2024 Record updated