CVE-2025-36070
📋 TL;DR
IBM Db2 databases running vulnerable versions can experience denial of service when specific SELECT queries are executed against certain table types, causing a trap (crash). This affects Db2 11.5.0-11.5.9 and 12.1.0-12.1.3 on Linux, UNIX, and Windows systems, including Db2 Connect Server installations.
💻 Affected Systems
- IBM Db2 for Linux, UNIX and Windows
- IBM Db2 Connect Server
📦 What is this software?
Db2 by Ibm
Db2 by Ibm
Db2 by Ibm
Db2 by Ibm
Db2 by Ibm
Db2 by Ibm
⚠️ Risk & Real-World Impact
Worst Case
Malicious actor executes crafted SELECT query causing Db2 instance to crash, resulting in complete database unavailability until manual restart.
Likely Case
Accidental or malicious query triggers trap, causing service interruption requiring database restart and potential transaction loss.
If Mitigated
With proper access controls and query validation, risk reduces to accidental triggering by authorized users with legitimate queries.
🎯 Exploit Status
Requires database credentials and knowledge of specific table types; no public exploit code available at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply fix packs: 11.5.9.0 Fix Pack 1 or later for 11.5.x, 12.1.3.0 Fix Pack 1 or later for 12.1.x
Vendor Advisory: https://www.ibm.com/support/pages/node/7257624
Restart Required: Yes
Instructions:
1. Download appropriate fix pack from IBM Fix Central. 2. Stop all Db2 instances and applications. 3. Apply fix pack following IBM installation guide. 4. Restart Db2 instances and verify functionality.
🔧 Temporary Workarounds
Restrict Database Access
allLimit database user permissions to only necessary tables and operations
REVOKE SELECT ON TABLE <table_name> FROM <user_or_group>
GRANT SELECT ON TABLE <safe_tables> TO <user_or_group>
Implement Query Monitoring
allMonitor and alert on unusual SELECT queries against system tables
db2pd -db <database> -appl
db2 get snapshot for database on <database>
🧯 If You Can't Patch
- Implement strict database user access controls and principle of least privilege
- Deploy network segmentation and firewall rules to restrict database access to trusted sources only
🔍 How to Verify
Check if Vulnerable:
Check Db2 version: db2level command output showing affected versions (11.5.0-11.5.9 or 12.1.0-12.1.3)Check Version:
db2level | grep 'Product name'Verify Fix Applied:
Verify version after patching: db2level should show 11.5.9.0 Fix Pack 1 or later, or 12.1.3.0 Fix Pack 1 or later📡 Detection & Monitoring
Log Indicators:
- Db2 trap/crash events in db2diag.log
- Unexpected database termination messages
- Abnormal SELECT query patterns in audit logs
Network Indicators:
- Sudden drop in database connections
- Failed connection attempts followed by service unavailability
SIEM Query:
source="db2diag.log" AND ("trap" OR "crash" OR "abend")