CVE-2025-36238: IBM PowerVM Hypervisor Info Disclosure

CVE-2025-36238 Overview

CVE-2025-36238 is an information disclosure vulnerability affecting IBM PowerVM Hypervisor across multiple firmware versions. The vulnerability allows a local user with administrative privileges to obtain sensitive information from a Virtual Trusted Platform Module (vTPM) through a series of PowerVM service procedures. This exposure of system information (CWE-497) could compromise the confidentiality of cryptographic keys and other sensitive data stored within the vTPM.

Critical Impact
Local administrators can extract sensitive vTPM data, potentially exposing cryptographic keys, attestation secrets, and other protected information managed by the Virtual TPM.

Affected Products

IBM PowerVM Hypervisor FW1110.00 through FW1110.03
IBM PowerVM Hypervisor FW1060.00 through FW1060.51
IBM PowerVM Hypervisor FW950.00 through FW950.F0

Discovery Timeline

2026-02-02 - CVE CVE-2025-36238 published to NVD
2026-02-03 - Last updated in NVD database

Technical Details for CVE-2025-36238

Vulnerability Analysis

This vulnerability represents an information exposure issue within the IBM PowerVM Hypervisor's Virtual TPM implementation. The Virtual TPM is a critical security component that provides hardware-based security functions to guest partitions, including secure key storage, cryptographic operations, and platform attestation.

The vulnerability exists in the handling of PowerVM service procedures, which are administrative operations used for system management and maintenance. When an authenticated administrator executes a specific sequence of these service procedures, the hypervisor fails to properly protect sensitive vTPM data, allowing the information to be extracted.

The attack requires local access and high privileges (administrative rights), which limits the attack surface. However, the scope extends beyond the vulnerable component—the changed scope indicates that a compromised hypervisor can affect resources in guest partitions that rely on the vTPM for security. The impact is purely on confidentiality, with no direct integrity or availability concerns.

Root Cause

The root cause is classified as CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere. The PowerVM service procedures do not implement adequate access controls or data sanitization when handling vTPM-related operations. This allows privileged users to access information that should remain protected even from administrative accounts, violating the principle of least privilege for sensitive cryptographic material.

Attack Vector

The attack requires local access to the PowerVM environment with administrative privileges. An attacker would need to:

Gain authenticated access to the Hardware Management Console (HMC) or equivalent management interface
Possess administrative privileges on the target managed system
Execute a specific sequence of PowerVM service procedures
Extract the exposed vTPM data from the procedure outputs

The vulnerability cannot be exploited remotely without first compromising administrative credentials. The attack does not require user interaction beyond the attacker's own actions.

Technical details regarding the specific service procedures involved are available in the IBM Support Page.

Detection Methods for CVE-2025-36238

Indicators of Compromise

Unusual or repeated execution of PowerVM service procedures targeting vTPM components
Administrative access patterns that deviate from normal operational baselines
Unexpected queries or data extraction from Virtual TPM subsystems
Anomalous HMC session activity from administrative accounts

Detection Strategies

Monitor HMC audit logs for service procedure executions, particularly those related to vTPM operations
Implement behavioral analysis for administrative accounts to detect unusual command sequences
Review PowerVM system logs for atypical vTPM access patterns
Correlate administrative session timing with known maintenance windows

Monitoring Recommendations

Enable comprehensive logging for all PowerVM service procedure invocations
Configure alerting for vTPM-related administrative operations outside scheduled maintenance
Implement privileged access management (PAM) solutions to track and audit administrative sessions
Establish baselines for normal administrative activity to identify anomalous behavior

How to Mitigate CVE-2025-36238

Immediate Actions Required

Review and restrict administrative access to PowerVM systems to only essential personnel
Audit current administrative accounts for necessity and appropriate privilege levels
Apply firmware updates from IBM as they become available
Implement additional monitoring for vTPM-related service procedures

Patch Information

IBM has released security advisories addressing this vulnerability. Administrators should consult the IBM Support Page for detailed patching instructions and updated firmware versions. Apply the latest firmware updates for affected PowerVM Hypervisor versions:

FW1110.xx series: Update to the latest available firmware beyond FW1110.03
FW1060.xx series: Update to the latest available firmware beyond FW1060.51
FW950.xx series: Update to the latest available firmware beyond FW950.F0

Workarounds

Implement strict role-based access controls limiting who can execute PowerVM service procedures
Enable comprehensive audit logging for all administrative actions on the HMC
Segment management networks to restrict access to PowerVM administrative interfaces
Consider implementing additional authentication factors for privileged operations

bash

# Example: Review HMC audit logs for service procedure activity
# Consult IBM documentation for specific log locations and formats
# Enable enhanced logging via HMC management interface
# Review administrative user accounts and permissions regularly