Description

IBM PowerVM Hypervisor FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the PowerVM hypervisor call interface. An attacker with root access to a guest partition can issue a specially crafted hypervisor call to inject an arbitrary amount of data into hypervisor or partition memory, resulting in either a crash causing a full platform re-IPL and terminating all hosted partitions, or corruption of hypervisor or partition memory. The PowerVM hypervisor will restart automatically; however, repeated exploitation could result in a sustained availability impact. Successful exploitation results in an integrity and availability impact to the managed system.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.4",
  "pubDate": "2026-08-19T20:17:12.460Z",
  "pubdate": "2026-08-19T20:17:12.460Z",
  "executiveSummary": "A memory injection vulnerability exists within the IBM PowerVM Hypervisor call interface, specifically affecting multiple firmware versions including FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2.\nThe vulnerability allows an authenticated attacker who has already attained root access within a local guest partition to exploit the hypervisor call mechanism.\nBy issuing a specially crafted hypervisor call, the attacker can inject an arbitrary amount of data directly into hypervisor or partition memory.\nSuccessful exploitation results in severe integrity and availability impacts.\nThe direct consequences of this memory corruption include triggering an immediate platform re-IPL (Initial Program Load), which terminates all currently hosted partitions and causes a full system crash.\nAlthough the PowerVM hypervisor restarts automatically following a crash, an adversary capable of repeated exploitation can induce a sustained denial of service and continuous availability impact against the managed system.\nThis vulnerability highlights critical security boundary enforcement risks between guest partitions and the underlying hypervisor architecture.",
  "technicalDetails": "The root cause of the vulnerability resides in the input validation and boundary checking logic of the PowerVM hypervisor call interface.\nHypervisor calls (hcalls) are privileged software traps executed by guest operating systems to request services from the underlying PowerVM hypervisor.\nIn the affected firmware versions—specifically FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2—the hypervisor fails to adequately validate the size and destination parameters supplied during specific hypervisor call operations initiated from a guest partition.\nTo exploit this vulnerability, an attacker must first establish root-level access within a local guest partition hosted on the target system, as unprivileged users lack the privilege requirements to issue arbitrary hypervisor calls directly.\nOnce root privileges are acquired within the guest partition, the attack flow proceeds by constructing a malicious hypervisor call payload.\nThis crafted payload exploits the missing length and bounds checks within the hypervisor call interface.\nWhen executed by the guest OS kernel, the hypervisor processes the malicious hcall and permits the injection of an arbitrary amount of data.\nBecause memory isolation boundaries are bypassed due to inadequate sanitization, the injected data overflows into sensitive regions of hypervisor memory or adjacent partition memory spaces.\nThis uncontrolled data injection causes immediate memory corruption within the hypervisor's operational space or alters critical control structures.\nThe post-exploitation impact manifests immediately as a system crash or exception state that the hypervisor cannot recover from dynamically, forcing the platform to initiate a full re-IPL.\nThe re-IPL process abruptly terminates all hosted partitions, leading to a total loss of service availability for all tenants on the managed system.\nRepeated execution of this attack sequence prevents sustained operational uptime, resulting in a persistent denial of service condition."
}