CVE-2025-0986

March 28, 2025, 6:11 p.m.

4.5
Medium

Description

IBM PowerVM Hypervisor FW1050.00 through FW1050.30 and FW1060.00 through FW1060.20 could allow a local user, under certain Linux processor combability mode configurations, to cause undetected data loss or errors when performing gzip compression using HW acceleration.

Product(s) Impacted

Vendor Product Versions
Ibm
  • Powervm Hypervisor
  • FW1050.00-FW1050.30, FW1060.00-FW1060.20

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-409
Improper Handling of Highly Compressed Data (Data Amplification)
The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a ibm powervm_hypervisor FW1050.00-FW1050.30 / / / / / / /
a ibm powervm_hypervisor FW1060.00-FW1060.20 / / / / / / /

References

https://www.ibm.com/support/pages/node/7229349

Tags

psirt@us.ibm.com
CWE-409
2025-03-28
CVE-2025-0986

CVSS Score

4.5 / 10

CVSS Data - 3.1

  • Attack Vector: LOCAL
  • Attack Complexity: HIGH
  • Privileges Required: NONE
  • Scope: CHANGED
  • Confidentiality Impact: NONE
  • Integrity Impact: LOW
  • Availability Impact: LOW

    • CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L

    View Vector String

Timeline

Published: March 28, 2025, 2:15 p.m.
Last Modified: March 28, 2025, 6:11 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

psirt@us.ibm.com

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.