CVE-2024-35152
📋 TL;DR
This vulnerability in IBM Db2 allows authenticated users to cause denial of service through specially crafted queries that trigger improper memory allocation. It affects IBM Db2 for Linux, UNIX and Windows (including Db2 Connect Server) version 11.5. Attackers need database credentials to exploit this issue.
💻 Affected Systems
- IBM Db2 for Linux, UNIX and Windows
- IBM Db2 Connect Server
📦 What is this software?
Db2 by Ibm
Db2 by Ibm
Db2 by Ibm
Db2 by Ibm
Db2 by Ibm
Db2 by Ibm
⚠️ Risk & Real-World Impact
Worst Case
Complete database service disruption requiring restart, potentially affecting all applications dependent on the Db2 instance.
Likely Case
Temporary service degradation or crash of specific database processes, requiring manual intervention to restore functionality.
If Mitigated
Minimal impact with proper query validation, memory monitoring, and restricted user privileges in place.
🎯 Exploit Status
Exploitation requires database credentials; no public exploit code has been disclosed as of the advisory date.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply fix pack as specified in IBM advisory (specific version depends on fix pack level)
Vendor Advisory: https://www.ibm.com/support/pages/node/7165342
Restart Required: Yes
Instructions:
1. Review IBM advisory for specific fix pack requirements. 2. Download appropriate fix pack from IBM Fix Central. 3. Apply fix pack following IBM Db2 installation procedures. 4. Restart Db2 services to complete installation.
🔧 Temporary Workarounds
Restrict Query Execution Privileges
allLimit which users can execute complex queries or use potentially dangerous SQL functions.
REVOKE EXECUTE ON PROCEDURE FROM USER <username>;
REVOKE SELECT, INSERT, UPDATE, DELETE ON TABLE <tablename> FROM USER <username>;
Implement Query Monitoring
allMonitor for unusual query patterns or memory-intensive operations.
db2pd -db <dbname> -dynamic
db2 get snapshot for database on <dbname>
🧯 If You Can't Patch
- Implement strict access controls to limit authenticated users who can execute queries
- Deploy network segmentation to isolate Db2 servers and monitor for anomalous query patterns
🔍 How to Verify
Check if Vulnerable:
Check Db2 version: db2level command output should show version 11.5 without appropriate fix pack applied.Check Version:
db2levelVerify Fix Applied:
Verify fix pack installation: db2level should show fix pack level mentioned in IBM advisory as remediated.📡 Detection & Monitoring
Log Indicators:
- Database crash logs
- Memory allocation errors in db2diag.log
- Abnormal query termination events
Network Indicators:
- Sudden drop in database connections
- Increased failed authentication attempts preceding DoS
SIEM Query:
source="db2diag.log" AND ("memory allocation" OR "out of memory" OR "SIGSEGV")