Patching VIOS

Edit online

Concert supports VIOS iFix detection as part of the IBM Power assessment. This feature improves the accuracy of vulnerability reporting by recognizing when an interim fix (iFix) is already installed on a VIOS host.

VIOS iFix detection during IBM Power assessments

The Virtual I/O Server (VIOS) iFix patching capability enables you to apply incremental fixes that remediate specific vulnerabilities without performing a full VIOS version upgrade.

Concert automatically validates dependencies, sequences the patches, and applies the selected iFixes through the IBM Power Auto Remediation workflows.

About VIOS iFix patching

A VIOS iFix is an incremental update that targets one or more specific vulnerabilities in a set of filesets. iFixes are applied in a strict dependency order based on their issue date. An iFix issued later cannot be installed unless its required base iFixes are also selected.

Concert automates:
  • Dependency sequencing (for example, iFix1 > iFix2 > iFix3)
  • Validation of prerequisite selections
  • Parallel installation of independent fixes
  • Real-time status updates during remediation execution
Table 1. Remediation states
Status Meaning
Completed All selected iFixes installed successfully.
Partially processed At least one iFix installed successfully and one or more dependent iFixes failed. Dependent iFixes are skipped and marked as Ignored.
Failed All iFixes failed or the action was aborted.

Review VIOS iFix patches

When Concert identifies missing VIOS iFixes during an assessment, it generates a patch remediation action for the affected VIOS host.

Follow these steps to review the patch details:
  1. Go to Dimensions > IBM Power > Actions.
  2. Click on the System or HMC.
  3. Go to the Actions tab for the selected system.
  4. Click Review and approve.
  5. Open the iFixes tab.
    Screenshot of IBM Power iFixes tab.
    This panel lists:
    • Available VIOS iFixes
    • Associated file sets
    • Whether a reboot is required
  6. Select the iFixes you want to apply.
    Screenshot of IBM Power select iFix option.
  7. Click Save.
  8. Click Approve.
    Screenshot of iFix approve.
  9. Provide a schedule and confirm by clicking Approve in the approval window.
    Screenshot of IBM Power final approval window.

After approval, Concert installs the selected iFixes sequentially. Each iFix addresses specific CVEs and behaves similarly to applying a targeted package fix rather than performing a full version update.

Apply VIOS iFix patches

  1. Review the selected iFixes and confirm the dependency sequence.
  2. Approve the remediation action.
  3. Concert performs the following steps:
    • Downloads the required iFix tar packages using secure channels (scp, wget)
    • Validates checksums
    • Applies the iFixes in sequence

If an iFix requires a reboot or partition migration, the remediation action includes instructions and prompts for selecting a target system for temporary partition migration. Review the action details before approval.

Partial success handling

If one or more iFixes fail during installation:
  • All dependent iFixes are skipped.
  • Skipped iFixes are marked as Ignored.
  • Successfully applied iFixes remain installed.
  • The overall action status is set to Partially Completed.

This behavior prevents dependency-chain errors and ensures the system remains in a valid state.