Description

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 allows a remote unauthenticated attacker can send a crafted UDP packet to a reachable RPC service, resulting in complete system unavailability and requiring an LPAR restart.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-20T22:17:18.273Z",
  "pubdate": "2026-08-20T22:17:18.273Z",
  "executiveSummary": "This vulnerability represents a denial of service flaw affecting IBM AIX and IBM PowerVM VIOS systems. The security defect allows a remote, unauthenticated attacker to cause complete system unavailability by interacting with a reachable RPC service.\nThe vulnerability impacts IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS version 4.1. Successful exploitation results in a catastrophic system crash that requires a manual LPAR restart to recover functionality.\nThe risk implications are severe due to the potential for unauthenticated, remote disruption of critical virtualized infrastructure and operating system environments without requiring prior access or specialized privileges.\nAttacker capabilities are limited to causing denial of service conditions; however, the lack of authentication requirements significantly lowers the barrier for exploitation. The attack vector relies on network reachability to the vulnerable RPC service.\nExploitation requirements include network connectivity to the target system where the RPC service is exposed and operational. The adversary must transmit a maliciously crafted UDP packet directly to the targeted service to trigger the failure.",
  "technicalDetails": "The vulnerability resides within the RPC service implementation present in the affected operating systems and hypervisor components. The root cause stems from improper input validation and memory handling when processing incoming remote procedure calls transmitted via UDP.\nThe vulnerable component is the RPC subsystem running on the network stack of IBM AIX 7.2, IBM AIX 7.3, and IBM PowerVM VIOS 4.1. Because the service listens on reachable network interfaces, it exposes a critical attack surface to remote entities.\nAuthentication requirements are entirely absent, meaning any unauthenticated network adversary can initiate the attack sequence. Privilege requirements are nonexistent prior to exploitation, as the interaction occurs entirely at the network service layer.\nNetwork exposure is a primary factor in this vulnerability. The RPC service must be accessible over the network for the attacker to deliver the malicious payload. The exploitation method involves sending a specifically crafted UDP packet designed to trigger an unhandled exception, assertion failure, or severe memory corruption within the RPC daemon or kernel-level handler.\nThe attack flow proceeds as follows: First, the remote unauthenticated attacker identifies a reachable RPC service on the target IBM AIX or IBM PowerVM VIOS instance. Second, the attacker formulates a payload encapsulated within a crafted UDP packet containing malformed parameters or protocol headers. Third, the attacker transmits this packet across the network to the listening RPC service port.\nUpon receipt, the vulnerable RPC component attempts to parse and process the malicious payload. Due to the lack of adequate bounds checking and error handling, the malformed input triggers an immediate and fatal system fault. This payload behavior causes the operating system or partition to crash instantaneously.\nThe post-exploitation impact is strictly localized to a denial of service condition characterized by total system unavailability. The immediate consequence is an abrupt crash of the logical partition (LPAR), disrupting all hosted workloads and services. Recovery from this state requires administrative intervention to perform a full LPAR restart."
}