CVE-2023-38368
📋 TL;DR
IBM Security Access Manager Docker versions 10.0.0.0 through 10.0.7.1 have improper permission controls that could allow local users to access sensitive information. This vulnerability affects organizations using these specific IBM containerized security products. The issue stems from incorrect access controls within the Docker container environment.
💻 Affected Systems
- IBM Security Access Manager Docker
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local attackers gain access to sensitive configuration data, credentials, or security policies that could be used to escalate privileges or compromise the security infrastructure.
Likely Case
Local users with basic access can read sensitive files or configuration data they shouldn't have access to, potentially exposing security settings or credentials.
If Mitigated
With proper access controls and container security hardening, impact is limited to authorized users only accessing their permitted resources.
🎯 Exploit Status
Exploitation requires local access to the Docker container. No public exploit code has been identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.0.7.2 or later
Vendor Advisory: https://www.ibm.com/support/pages/node/7158790
Restart Required: Yes
Instructions:
1. Download IBM Security Access Manager Docker version 10.0.7.2 or later from IBM Fix Central. 2. Stop the affected container. 3. Deploy the updated container image. 4. Restart the container with the new image.
🔧 Temporary Workarounds
Restrict Container Access
linuxLimit local user access to Docker containers running IBM Security Access Manager
docker update --restart=no [container_name]
chmod 750 /var/run/docker.sock
usermod -aG docker [authorized_users_only]
Implement Docker Security Best Practices
linuxApply Docker security hardening to limit container capabilities
docker run --cap-drop=ALL --cap-add=NET_BIND_SERVICE [other_required_caps] [image]
docker run --read-only [image]
docker run --security-opt=no-new-privileges [image]
🧯 If You Can't Patch
- Implement strict access controls to limit who can access Docker containers and host systems
- Monitor container access logs and file access patterns for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check IBM Security Access Manager Docker version: docker inspect [container_name] | grep -i versionCheck Version:
docker inspect [container_name] | grep -i 'version\|image'Verify Fix Applied:
Verify version is 10.0.7.2 or later: docker inspect [container_name] | grep -i version📡 Detection & Monitoring
Log Indicators:
- Unauthorized file access attempts within Docker containers
- Suspicious user activity on Docker host with access to IBM containers
- Access to sensitive configuration files by non-privileged users
Network Indicators:
- N/A - Local vulnerability only
SIEM Query:
source="docker" AND (container_name="*ibm*access*manager*" OR image="*ibm*access*manager*") AND (event="file_access" OR event="permission_denied")