CVE-2025-36194: IBM PowerVM Information Disclosure Flaw

CVE-2025-36194 Overview

IBM PowerVM Hypervisor FW1110.00 through FW1110.03, FW1060.00 through FW1060.51, and FW950.00 through FW950.F0 may expose a limited amount of data to a peer partition in specific shared processor configurations during certain operations. This information disclosure vulnerability affects IBM PowerVM hypervisor firmware across multiple firmware version branches.

Critical Impact

In shared processor configurations, data from one partition may be inadvertently exposed to a peer partition during specific operations, potentially compromising partition isolation.

Affected Products

• IBM PowerVM Hypervisor FW1110.00 through FW1110.03
• IBM PowerVM Hypervisor FW1060.00 through FW1060.51
• IBM PowerVM Hypervisor FW950.00 through FW950.F0

Discovery Timeline

• 2026-02-02 - CVE CVE-2025-36194 published to NVD
• 2026-02-03 - Last updated in NVD database

Technical Details for CVE-2025-36194

Vulnerability Analysis

This vulnerability is classified under CWE-1262 (Improper Access Control for Register Interface). The issue resides in how IBM PowerVM Hypervisor handles shared processor configurations, where register-level access controls fail to properly isolate data between peer partitions during specific operational contexts.

The vulnerability requires local access to the system and involves high attack complexity, as exploitation depends on specific shared processor configurations being in place and certain operations occurring. An attacker with low privileges could potentially read a limited amount of data belonging to a peer partition.

Root Cause

The root cause stems from improper access control mechanisms at the register interface level within the PowerVM Hypervisor. When partitions share processor resources in specific configurations, the hypervisor fails to adequately enforce data isolation boundaries during certain operations, allowing register-level data leakage between partitions.

Attack Vector

The attack vector requires local access to a partition within an affected IBM PowerVM environment. An attacker would need:

1. Access to a logical partition (LPAR) running on affected PowerVM Hypervisor firmware
2. The target system must be configured with shared processor pools
3. Specific timing conditions during processor state transitions

The exploitation mechanism involves observing register data during partition context switches in shared processor environments. Due to the high complexity requirements and specific configuration dependencies, exploitation in real-world scenarios remains challenging.

Detection Methods for CVE-2025-36194

Indicators of Compromise

• Unusual data patterns observed in partition memory that do not correlate with expected workloads
• Anomalous processor utilization patterns in shared processor pool configurations
• Unexpected inter-partition communication or data artifacts

Detection Strategies

• Monitor partition isolation metrics provided by the Hardware Management Console (HMC)
• Implement firmware version auditing to identify systems running affected firmware versions
• Enable enhanced logging for shared processor pool operations where available

Monitoring Recommendations

• Establish baseline processor utilization patterns for each partition in shared processor configurations
• Implement regular firmware inventory checks to ensure all systems are updated to patched versions
• Configure alerts for any partition boundary violations detected by PowerVM management tools

How to Mitigate CVE-2025-36194

Immediate Actions Required

• Verify current firmware versions across all PowerVM Hypervisor systems using HMC or command-line tools
• Review shared processor configurations and identify systems potentially at risk
• Schedule firmware updates during maintenance windows for affected systems
• Consider temporarily migrating sensitive workloads to dedicated processor configurations until patching is complete

Patch Information

IBM has released security updates to address this vulnerability. Administrators should consult the IBM Support Page for detailed patch information and download links for updated firmware versions. Ensure all PowerVM Hypervisor instances are updated beyond the affected version ranges:

• FW1110 branch: Update beyond FW1110.03
• FW1060 branch: Update beyond FW1060.51
• FW950 branch: Update beyond FW950.F0

Workarounds

• Where feasible, reconfigure affected systems to use dedicated processor mode instead of shared processor configurations
• Implement additional partition isolation by segregating sensitive workloads onto separate physical systems
• Restrict local access to partitions to minimize the attack surface until patches can be applied

# Verify current firmware version via HMC CLI
lssyscfg -r sys -F name,curr_sys_keylock,sys_firmware_level

# List partition processor configurations
lshwres -r proc -m <managed_system_name> --level lpar