CVE-2024-47102
📋 TL;DR
A local privilege escalation vulnerability in IBM AIX's perfstat kernel extension allows non-privileged local users to cause a denial of service. This affects IBM AIX 7.2, 7.3, VIOS 3.1, and 4.1 systems. The vulnerability stems from improper authorization (CWE-863) in the kernel extension.
💻 Affected Systems
- IBM AIX
- IBM VIOS
📦 What is this software?
Aix by Ibm
Aix by Ibm
⚠️ Risk & Real-World Impact
Worst Case
Complete system crash or kernel panic leading to sustained denial of service, requiring physical or remote console intervention to reboot.
Likely Case
Temporary system instability or service disruption affecting performance and availability of the affected AIX system.
If Mitigated
Minimal impact if proper access controls limit local user accounts and monitoring detects abnormal system behavior.
🎯 Exploit Status
Exploitation requires local user access but appears straightforward based on the CWE classification and CVSS score.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: AIX 7.2 TL5 SP2, 7.3 TL3 SP2; VIOS 3.1.3.40, 4.1.0.10
Vendor Advisory: https://www.ibm.com/support/pages/node/7179826
Restart Required: Yes
Instructions:
1. Download appropriate fix from IBM Fix Central. 2. Install interim fix or service pack using 'installp' or 'emgr'. 3. Reboot system to load patched kernel extension.
🔧 Temporary Workarounds
Restrict local user access
aixLimit non-essential local user accounts and implement strict access controls to reduce attack surface.
chuser login=false <username>
rmuser <username>
Monitor perfstat system calls
aixImplement auditing and monitoring of perfstat-related system calls for abnormal patterns.
auditpr -v -e event=perfstat
🧯 If You Can't Patch
- Implement strict least-privilege access controls for local user accounts
- Deploy enhanced monitoring for system stability and kernel panic events
🔍 How to Verify
Check if Vulnerable:
Check OS version with 'oslevel -s' and compare against affected versions. Check if perfstat kernel extension is loaded.Check Version:
oslevel -sVerify Fix Applied:
Verify installed fixes with 'lslpp -l | grep -i perfstat' and confirm oslevel matches patched versions.📡 Detection & Monitoring
Log Indicators:
- Kernel panic messages in /var/adm/ras/errlog
- System crash dumps
- Abnormal perfstat system calls in audit logs
Network Indicators:
- None - this is local-only exploitation
SIEM Query:
source="aix_errlog" AND "panic" OR "crash" OR source="aix_audit" AND "perfstat"