IBM PowerVM Hypervisor versions FW1110.00 to FW1110.20 and FW1060.00 to FW1060.71 suffer from insufficient entropy in the cryptographic processes of the Transparent Memory Encryption (TME) hardware. This weakness could enable an attacker with physical access to the hardware to decrypt memory contents that are supposed to be protected by encryption. The vulnerability is identified as CWE-331 (Insufficient Entropy) and has a CVSS 3.1 base score of 4.2, reflecting a medium severity with high impact on confidentiality but requiring physical access and high attack complexity.

An attacker with physical access to the affected IBM PowerVM Hypervisor hardware could decrypt memory encrypted by the Transparent Memory Encryption feature due to insufficient entropy in the cryptographic process. This compromises confidentiality of sensitive data in memory. There is no impact on integrity or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official remediation or patch information is provided, monitor IBM advisories for updates. Physical access controls should be enforced to reduce risk.