IBM PowerVM Hypervisor's Platform KeyStore (PKS) and virtual TPM firmware versions FW1110.00 to FW1110.20, FW1060.00 to FW1060.71, and FW950.00 to FW950.H2 use persistent storage key seeds that do not provide sufficient entropy. This weakness leads to AES keys with reduced cryptographic strength. An attacker who has high privileges and access to the service processor or HMC could exploit this to derive the encryption key, compromising data confidentiality. The CVSS 3.1 base score is 5.1, reflecting a medium severity with attack vector requiring adjacent network access, high attack complexity, high privileges, and user interaction. The vulnerability does not impact integrity or availability but has a high impact on confidentiality. No official patch or remediation guidance is currently available.

The vulnerability allows an attacker with access to the service processor or HMC and high privileges to derive AES encryption keys protecting data in the PowerVM Hypervisor Platform KeyStore and virtual TPM. This compromises the confidentiality of the encrypted data. There is no impact on data integrity or availability. The attack complexity is high and requires user interaction, limiting the ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the service processor and HMC to trusted administrators only and monitor for unauthorized access attempts. No official remediation or temporary fix is currently documented.