CVE-2025-36123
📋 TL;DR
This vulnerability in IBM Db2 allows a local user to cause a denial of service by copying large tables containing XML data, due to improper system resource allocation. It affects IBM Db2 for Linux, UNIX and Windows (including DB2 Connect Server) versions 11.5.0-11.5.9 and 12.1.0-12.1.3. Only local authenticated users can exploit this vulnerability.
💻 Affected Systems
- IBM Db2 for Linux, UNIX and Windows
- DB2 Connect Server
📦 What is this software?
Db2 by Ibm
Db2 by Ibm
Db2 by Ibm
Db2 by Ibm
Db2 by Ibm
Db2 by Ibm
⚠️ Risk & Real-World Impact
Worst Case
Complete database unavailability due to resource exhaustion, affecting all database services and dependent applications.
Likely Case
Temporary service degradation or crash of specific database processes when users perform large XML table copy operations.
If Mitigated
Minimal impact with proper access controls limiting local user privileges and monitoring for abnormal resource usage.
🎯 Exploit Status
Exploitation requires local authenticated access and specific database privileges to perform table copy operations with XML data.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply fixes from IBM advisory - specific fix versions not specified in CVE description
Vendor Advisory: https://www.ibm.com/support/pages/node/7257627
Restart Required: Yes
Instructions:
1. Review IBM advisory at provided URL. 2. Apply appropriate fix pack or interim fix from IBM. 3. Restart Db2 services. 4. Test functionality after patching.
🔧 Temporary Workarounds
Restrict table copy permissions
allLimit database user privileges to prevent unauthorized table copy operations
REVOKE COPY TABLE ON SCHEMA.TABLE FROM USERNAME;
REVOKE DBADM AUTHORITY FROM USERNAME;
Implement resource limits
allConfigure database resource limits to prevent excessive resource consumption
UPDATE DATABASE CONFIGURATION USING MAXAPPLS 100;
UPDATE DATABASE CONFIGURATION USING MAXLOCKS 10000;
🧯 If You Can't Patch
- Implement strict access controls to limit which users can perform table copy operations
- Monitor database logs for abnormal table copy activities and implement alerting
🔍 How to Verify
Check if Vulnerable:
Check Db2 version: db2level | grep 'Product is installed at' and compare with affected versions 11.5.0-11.5.9 or 12.1.0-12.1.3Check Version:
db2levelVerify Fix Applied:
Verify version after patch: db2level and confirm version is above affected ranges. Check IBM fix list for specific fix pack.📡 Detection & Monitoring
Log Indicators:
- Excessive memory allocation errors in db2diag.log
- Table copy operations with XML data taking unusually long
- Database crash or restart events
Network Indicators:
- Increased database response times
- Connection timeouts to Db2 services
SIEM Query:
source="db2diag.log" AND ("memory allocation" OR "resource exhausted" OR "copy table")