PowerVM

Power Virtualization

Learn about the virtualization technologies designed specifically for IBM Power including #PowerVM, #PowerVC, #VM Recovery Manager, #HCM/CMC, and more.


#Power
#TechXchangeConferenceLab

 View Only

  • 1.  Will patching for CVE-2024-27273 also address CVE-2023-7104?

    Posted Mon May 06, 2024 02:04 PM
    If I patch for CVE-2024-27273 will that also address CVE-2023-7104 or are they independent?  I can always hope, can't I?  Especially when you see lines like "The fixes are cumulative and address previously issued AIX/VIOS kernel security and HIPER bulletins with respect to SP and TL, which includes:"
     
    Security Bulletin: AIX is vulnerable to privilege escalation (CVE-2024-27273)
    https://www.ibm.com/support/pages/node/7150297
     
    Security Bulletin: AIX is vulnerable to arbitrary code execution due to RPM (CVE-2023-7104)
    https://www.ibm.com/support/pages/node/7149427


    ------------------------------
    Robert Berendt IBMChampion
    ------------------------------

    #PowerVM


  • 2.  RE: Will patching for CVE-2024-27273 also address CVE-2023-7104?
    Best Answer

    Posted Tue May 07, 2024 02:25 AM

    Hi Robert,

    At least from Quick Look, I would say those are definitely independent , fixing totally different filesets ( CVE-2024-27273 > bos.mp64; CVE-2023-7104 > rpm.rte)

    CVE-2023-7104 does not seem that critical (CVSS Base score 5.5), but the newer one CVE-2024-27273 I would recommend patching quite quickly, if possible.

    ( if not, it will be fixed in next Service Pack releases, which come out next month)

    Br,

    tommi



    ------------------------------
    Tommi Sihvo, Lead Service Architect
    Tietoevry Tech Services
    email tommi.sihvo@tietoevry.com mobile +358 (0)40 5180 Finland
    ------------------------------



  • 3.  RE: Will patching for CVE-2024-27273 also address CVE-2023-7104?

    Posted Wed May 22, 2024 10:42 AM

    Thank you.  I now have these on four of our six VIOS partitions.



    ------------------------------
    Robert Berendt IBMChampion
    ------------------------------

    Original Message


  • 4.  RE: Will patching for CVE-2024-27273 also address CVE-2023-7104?

    Posted Tue May 07, 2024 04:50 AM

    Hi Robert,

    They are independant.  They are in two separate filesets (packages) and are applied separately.  When they say cumulatively, this is within an individual fileset/package, not across filesets/packages.

    The affected filesets are:

    rpm.rte

    bos.mp64 (The AIX Kernel)

    Phill.



    ------------------------------
    Phill Rowbottom
    ------------------------------



Related Content