CVE-2024-35142
📋 TL;DR
This vulnerability in IBM Security Verify Access Docker allows local users to escalate their privileges by exploiting unnecessary privilege execution. It affects IBM Security Verify Access Docker versions 10.0.0 through 10.0.6. Attackers with local access can gain elevated permissions on affected systems.
💻 Affected Systems
- IBM Security Verify Access Docker
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains root/administrator privileges, compromising the entire container and potentially the host system through container escape techniques.
Likely Case
Local user escalates to higher privileges within the container, enabling unauthorized access to sensitive data and configuration.
If Mitigated
With proper access controls and container isolation, impact is limited to the specific container instance.
🎯 Exploit Status
Requires local access to the container. No public exploit code available as of analysis.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.0.6.1 or later
Vendor Advisory: https://www.ibm.com/support/pages/node/7155356
Restart Required: Yes
Instructions:
1. Update to IBM Security Verify Access Docker version 10.0.6.1 or later. 2. Rebuild and redeploy affected containers. 3. Verify the update was successful.
🔧 Temporary Workarounds
Container Privilege Reduction
linuxRun containers with minimal privileges using Docker security options
docker run --security-opt=no-new-privileges --cap-drop=ALL --cap-add=NET_BIND_SERVICE [image]
User Namespace Remapping
linuxUse Docker user namespace isolation to prevent privilege escalation
dockerd --userns-remap=default
🧯 If You Can't Patch
- Implement strict access controls to limit who can access Docker containers
- Monitor container activity for privilege escalation attempts and unauthorized access
🔍 How to Verify
Check if Vulnerable:
Check IBM Security Verify Access Docker version: docker inspect [container] | grep -i versionCheck Version:
docker inspect [container_name] | grep -A5 -B5 'IBM.*Verify.*Access'Verify Fix Applied:
Verify version is 10.0.6.1 or later and test privilege escalation attempts fail📡 Detection & Monitoring
Log Indicators:
- Unexpected privilege escalation events in container logs
- Failed sudo/su attempts from non-admin users
- Changes to user/group permissions
Network Indicators:
- Unusual outbound connections from containers after local access
SIEM Query:
source="docker" AND (event="privilege_escalation" OR user_change="root")