PowerVM

 View Only

  • 1.  Will patching for CVE-2024-27273 also address CVE-2023-7104?

    IBM Champion
    Posted Mon May 06, 2024 02:04 PM
    If I patch for CVE-2024-27273 will that also address CVE-2023-7104 or are they independent?  I can always hope, can't I?  Especially when you see lines like "The fixes are cumulative and address previously issued AIX/VIOS kernel security and HIPER bulletins with respect to SP and TL, which includes:"
     
    Security Bulletin: AIX is vulnerable to privilege escalation (CVE-2024-27273)
    https://www.ibm.com/support/pages/node/7150297
     
    Security Bulletin: AIX is vulnerable to arbitrary code execution due to RPM (CVE-2023-7104)
    https://www.ibm.com/support/pages/node/7149427


    ------------------------------
    Robert Berendt IBMChampion
    ------------------------------


  • 2.  RE: Will patching for CVE-2024-27273 also address CVE-2023-7104?
    Best Answer

    IBM Champion
    Posted Tue May 07, 2024 02:25 AM

    Hi Robert,

    At least from Quick Look, I would say those are definitely independent , fixing totally different filesets ( CVE-2024-27273 > bos.mp64; CVE-2023-7104 > rpm.rte)

    CVE-2023-7104 does not seem that critical (CVSS Base score 5.5), but the newer one CVE-2024-27273 I would recommend patching quite quickly, if possible.

    ( if not, it will be fixed in next Service Pack releases, which come out next month)

    Br,

    tommi



    ------------------------------
    Tommi Sihvo, Lead Service Architect
    Tietoevry Tech Services
    email tommi.sihvo@tietoevry.com mobile +358 (0)40 5180 Finland
    ------------------------------

    Original Message


  • 3.  RE: Will patching for CVE-2024-27273 also address CVE-2023-7104?

    IBM Champion
    Posted Wed May 22, 2024 10:42 AM

    Thank you.  I now have these on four of our six VIOS partitions.



    ------------------------------
    Robert Berendt IBMChampion
    ------------------------------

    Original Message


  • 4.  RE: Will patching for CVE-2024-27273 also address CVE-2023-7104?

    Posted Tue May 07, 2024 04:50 AM

    Hi Robert,

    They are independant.  They are in two separate filesets (packages) and are applied separately.  When they say cumulatively, this is within an individual fileset/package, not across filesets/packages.

    The affected filesets are:

    rpm.rte

    bos.mp64 (The AIX Kernel)

    Phill.



    ------------------------------
    Phill Rowbottom
    ------------------------------

    Original Message