Security Bulletin: IBM i is vulnerable to a local privilege escalation due to an unqualified library call in IBM Performance Tools for i [CVE-2024-27264].

Summary

IBM i is vulnerable to a user gaining elevated privilege due to a program being called without library qualification in IBM Performance Tools for i as described in the vulnerability details section. This bulletin identifies the steps to take to address the vulnerability as described in the remediation/fixes section.

Vulnerability Details

CVEID:CVE-2024-27264
**DESCRIPTION:**IBM Performance Tools for i could allow a local user to gain elevated privileges due to an unqualified library call. A malicious actor could cause user-controlled code to run with administrator privilege.
CVSS Base score: 7.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/284563 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Remediation/Fixes

The issue can be fixed by applying PTFs to IBM i. IBM i releases 7.5, 7.4, 7.3, and 7.2 will be fixed.

The IBM i PTF numbers for 5770-PT1 contain the fixes for the vulnerability. IBM i 7.5 5770-PT1 is a skip ship product.

IBM i Release

|

5770-PT1
PTF Number

|

PTF Download Link

—|—|—
7.5|

SJ00164
SJ00167
SJ00275

|

<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00164&gt;
<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00167&gt;
<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00275&gt;

7.4|

SJ00164
SJ00167
SJ00275

|

<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00164&gt;
<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00167&gt;
<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00275&gt;

7.3|

SJ00163
SJ00166
SJ00274

|

<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00163&gt;
<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00166&gt;
<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00274&gt;

7.2|

SJ00162
SJ00165
SJ00273

|

<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00162&gt;
<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00165&gt;
<https://www.ibm.com/mysupport/s/fix-information?legacy=SJ00273&gt;

<https://www.ibm.com/support/fixcentral&gt;

Important note: IBM recommends that all users running unsupported versions of affected products upgrade to supported and fixed version of affected products.

Workarounds and Mitigations

None