Description

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an improper calculation of a memory offset during IPsec decapsulation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-20T15:17:28.607Z",
  "pubdate": "2026-08-20T15:17:28.607Z",
  "executiveSummary": "A denial of service vulnerability exists in IBM AIX 7.2, IBM AIX 7.3, and IBM PowerVM VIOS 4.1. The flaw arises from an improper calculation of a memory offset during the IPsec decapsulation process within the network stack. A remote attacker can exploit this weakness by transmitting specially crafted IPsec packets to the targeted system.\nSuccessful exploitation of this vulnerability leads to a denial of service condition, disrupting system availability and potentially causing system instability or crashes. The affected products include IBM AIX versions 7.2 and 7.3, alongside IBM PowerVM VIOS version 4.1.\nThe attack vector is network-based, allowing remote adversaries to trigger the memory offset calculation error without requiring prior authentication or elevated privileges. Given that IPsec protocols handle encrypted network traffic, parsing anomalies during decapsulation bypass standard packet inspection boundaries, directly impacting kernel-level memory management and system stability.\nOrganizations utilizing the affected IBM AIX and PowerVM VIOS platforms must apply official vendor-supplied patches and follow hardening guidelines to restrict unauthorized network exposure to IPsec services.",
  "technicalDetails": "The vulnerability resides within the network stack implementation responsible for handling IPsec decapsulation in IBM AIX 7.2, IBM AIX 7.3, and IBM PowerVM VIOS 4.1. The root cause of the flaw is an improper calculation of a memory offset when the kernel parses incoming IPsec-encapsulated packets.\nDuring the decapsulation phase, the kernel attempts to compute memory offsets to strip encapsulation headers and process the inner packet payload. Due to flawed arithmetic or insufficient bounds checking during this calculation, a manipulated packet header can force the kernel to evaluate an incorrect memory address or pointer offset.\nThe attack flow begins when a remote attacker, operating across the network, transmits a maliciously crafted IPsec packet targeting a vulnerable host. Upon receipt, the network interface driver and IPsec subsystem process the packet headers. When the vulnerable component executes the improper memory offset calculation during decapsulation, it triggers a fatal memory access violation, kernel panic, or unhandled exception.\nBecause this operation occurs within kernel space during low-level packet processing, the resulting exception immediately compromises the availability of the operating system. The vulnerability requires network access to the IPsec service, but does not necessitate user authentication, local interaction, or specific privileges, making it accessible to any remote adversary capable of sending traffic to the target.\nThe post-exploitation impact is strictly limited to a denial of service, as the primary manifestation of the flaw is system instability or an abrupt crash rather than arbitrary code execution or privilege escalation. Remediation requires addressing the offset calculation logic within the affected kernel modules."
}