CVE-2024-35139
📋 TL;DR
This vulnerability in IBM Security Access Manager Docker allows local users to access sensitive information within the container due to incorrect default permissions. It affects IBM Security Access Manager Docker versions 10.0.0.0 through 10.0.7.1. The issue stems from improper file/directory permissions that expose sensitive data to unauthorized local users.
💻 Affected Systems
- IBM Security Access Manager Docker
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local attackers could access sensitive configuration files, credentials, or cryptographic materials, potentially leading to privilege escalation, lateral movement, or complete container compromise.
Likely Case
Local users with access to the container can read sensitive files they shouldn't have access to, potentially exposing configuration details, logs, or other restricted information.
If Mitigated
With proper container isolation and least-privilege access controls, the impact is limited to information disclosure within the container boundary.
🎯 Exploit Status
Exploitation requires local access to the container and involves reading files with incorrect permissions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.0.7.2 or later
Vendor Advisory: https://www.ibm.com/support/pages/node/7158790
Restart Required: Yes
Instructions:
1. Update to IBM Security Access Manager Docker version 10.0.7.2 or later. 2. Pull the updated container image from IBM's registry. 3. Redeploy containers with the updated image. 4. Verify the fix by checking container version and permissions.
🔧 Temporary Workarounds
Manual permission hardening
linuxManually adjust file and directory permissions within the container to restrict access to sensitive files.
docker exec <container_name> chmod 600 /path/to/sensitive/file
docker exec <container_name> chown root:root /path/to/sensitive/file
Container isolation
linuxImplement strict container isolation and limit local user access to the container.
docker run --read-only --security-opt=no-new-privileges --cap-drop=ALL <image>
🧯 If You Can't Patch
- Implement strict access controls to limit who can access the Docker containers.
- Monitor container access and file access patterns for suspicious activity.
🔍 How to Verify
Check if Vulnerable:
Check if running IBM Security Access Manager Docker version between 10.0.0.0 and 10.0.7.1, and verify sensitive file permissions within the container.Check Version:
docker exec <container_name> /opt/ibm/isam/bin/version.shVerify Fix Applied:
Verify container is running version 10.0.7.2 or later and check that sensitive files have proper restrictive permissions (e.g., 600 for files, 700 for directories).📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns within container logs
- Permission change events in container audit logs
Network Indicators:
- N/A - local vulnerability only
SIEM Query:
container.name:"ibm-security-access-manager" AND (event.action:"file_read" OR event.action:"permission_change") AND file.path:"/opt/ibm/isam/*"