SB2026100918 - IBM PowerVM Hypervisor update for RSA OAEP

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026100918

SB2026100918 - IBM PowerVM Hypervisor update for RSA OAEP

Published: October 9, 2026

Security Bulletin ID SB2026100918
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Information Exposure Through Timing Discrepancy (CVE-ID: CVE-2026-6727)

CWE-ID: CWE-208 - Information Exposure Through Timing Discrepancy

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to observable timing discrepancy in TPM 2.0 RSA OAEP secret decryption when modifying the encrypted secret and observing precise decryption timing. A remote attacker can perform repeated crafted decryption attempts and measure timing differences to disclose sensitive information.

Exploitation requires the ability to modify the stored encrypted secret and to accurately observe precise timing across many decryption attempts in order to infer the original secret.


Remediation

Install update from vendor's website.

References