IBM PowerVM Hypervisor versions FW1120.00 to FW1120.01, FW1110.00 to FW1110.31, and FW1060.00 to FW1060.81 contain a vulnerability (CWE-457: Use of Uninitialized Variable) in the hypervisor call interface. This flaw allows an attacker with root privileges on a guest partition to read a limited portion of hypervisor memory. The attacker does not have control over which memory is exposed, but the data could include sensitive information from the hypervisor or other guest partitions. This confidentiality impact is significant in multi-tenant environments. The vulnerability does not affect integrity or availability. No known exploits are reported in the wild. The CVSS v3.1 base score is 3.2, reflecting low severity.

An attacker with root access to a guest partition can read a limited amount of hypervisor memory, potentially exposing sensitive data belonging to the hypervisor or other guest partitions. The attacker cannot control the memory contents returned. There is a confidentiality impact only; integrity and availability are not affected. This is especially relevant in multi-tenant environments where guests run arbitrary OS images.

No patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until a fix is available, restrict root access to guest partitions and monitor for suspicious activity. Consider isolating sensitive workloads to reduce risk.