IBME3782C46B6A192A61EAB01AE64B8196BEC413E4DDD0CA285A8E5C67E78D89F9A

HistoryApr 27, 2024 - 4:44 p.m.

Security Bulletin: IBM i is vulnerable to a local privilege escalation due to an unqualified library call in networking and compiler infrastructure [CVE-2024-25050]

2024-04-2716:44:32

www.ibm.com

ibm i

local privilege escalation

unqualified library call

networking

compiler infrastructure

vulnerability

cve-2024-25050

ptfs

7.5

7.4

7.3

7.2

fix

si86029

si86085

si86108

si86125

si86236

si86244

si86248

si86251

sj00060

sj00086

sj00098

sj00110

sj00127

sj00156

sj00209

sj00307

sj00332

sj00337

sj00340

sj00445

sj00447

sj00523

CVSS3

8.4

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.1

Confidence

High

EPSS

Percentile

15.5%

JSON

Summary

IBM i is vulnerable to a user gaining elevated privilege due to a CL command being called without library qualification in networking and compiler infrastructure as described in the vulnerability details section. This bulletin identifies the steps to take to address the vulnerability as described in the remediation/fixes section.

Vulnerability Details

CVEID:CVE-2024-25050
**DESCRIPTION:**IBM i networking and compiler infrastructure could allow a local user to gain elevated privileges due to an unqualified library call. A malicious actor could cause user-controlled code to run with administrator privilege.
CVSS Base score: 8.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/283242 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM i	7.5
IBM i	7.4
IBM i	7.3
IBM i	7.2

Remediation/Fixes

The issue can be fixed by applying PTFs to IBM i. IBM i releases 7.5, 7.4, 7.3, and 7.2 will be fixed.

The IBM i PTF numbers for 5770-SS1 *BASE and Option 12 (12) contain the fixes for the vulnerability.

IBM i Release

5770-SS1

PTF Download Link

—|—|—
7.5|

SI86029
SI86085
SI86108
SI86125
SI86236
SI86244
SI86248
SI86251
SJ00060
SJ00086 (12)
SJ00098 (12)
SJ00110
SJ00127
SJ00156
SJ00209
SJ00307
SJ00332
SJ00337
SJ00340
SJ00445
SJ00447
SJ00523

7.4|

SI86026
SI86044
SI86074
SI86086
SI86124
SI86243
SI86247
SJ00004
SJ00059
SJ00087 (12)
SJ00099 (12)
SJ00109
SJ00155
SJ00208
SJ00331
SJ00333
SJ00336
SJ00341
SJ00444
SJ00446
SJ00529

7.3|

SI85978
SI86023
SI86058
SI86089
SI86123
SI86242
SI86246
SJ00019
SJ00058
SJ00088 (12)
SJ00100 (12)
SJ00108
SJ00154
SJ00207
SJ00330
SJ00335
SJ00339
SJ00342
SJ00443
SJ00533

7.2|

SI85970
SI85981
SI85995
SI86092
SI86103
SI86241
SI86245
SJ00020
SJ00057
SJ00089 (12)
SJ00101 (12)
SJ00107
SJ00153
SJ00206
SJ00317
SJ00329
SJ00338
SJ00401
SJ00538

<https://www.ibm.com/support/fixcentral>

Important note: IBM recommends that all users running unsupported versions of affected products upgrade to supported and fixed version of affected products.

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmiMatch7.5.0

ibmiMatch7.4.0

ibmiMatch7.3.0

ibmiMatch7.2.0

ibmplanning_analyticsMatch7.4.0

ibmibm_i_7.5_preventative_service_planningMatch7.5.0

ibmplanning_analyticsMatch7.2.0

ibmplanning_analyticsMatch7.3.0

VendorProductVersionCPE
ibmi7.5.0cpe:2.3:o:ibm:i:7.5.0:*:*:*:*:*:*:*
ibmi7.4.0cpe:2.3:o:ibm:i:7.4.0:*:*:*:*:*:*:*
ibmi7.3.0cpe:2.3:o:ibm:i:7.3.0:*:*:*:*:*:*:*
ibmi7.2.0cpe:2.3:o:ibm:i:7.2.0:*:*:*:*:*:*:*
ibmplanning_analytics7.4.0cpe:2.3:a:ibm:planning_analytics:7.4.0:*:*:*:*:*:*:*
ibmibm_i_7.5_preventative_service_planning7.5.0cpe:2.3:a:ibm:ibm_i_7.5_preventative_service_planning:7.5.0:*:*:*:*:*:*:*
ibmplanning_analytics7.2.0cpe:2.3:a:ibm:planning_analytics:7.2.0:*:*:*:*:*:*:*
ibmplanning_analytics7.3.0cpe:2.3:a:ibm:planning_analytics:7.3.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	i	7.5.0	cpe:2.3:o:ibm:i:7.5.0:::::::*
ibm	i	7.4.0	cpe:2.3:o:ibm:i:7.4.0:::::::*
ibm	i	7.3.0	cpe:2.3:o:ibm:i:7.3.0:::::::*
ibm	i	7.2.0	cpe:2.3:o:ibm:i:7.2.0:::::::*
ibm	planning_analytics	7.4.0	cpe:2.3:a:ibm:planning_analytics:7.4.0:::::::*
ibm	ibm_i_7.5_preventative_service_planning	7.5.0	cpe:2.3:a:ibm:ibm_i_7.5_preventative_service_planning:7.5.0:::::::*
ibm	planning_analytics	7.2.0	cpe:2.3:a:ibm:planning_analytics:7.2.0:::::::*
ibm	planning_analytics	7.3.0	cpe:2.3:a:ibm:planning_analytics:7.3.0:::::::*

CVSS3

8.4

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.1

Confidence

High

EPSS

Percentile

15.5%

JSON

Related for E3782C46B6A192A61EAB01AE64B8196BEC413E4DDD0CA285A8E5C67E78D89F9A