IBM i is vulnerable to a local privilege escalation due to a flaw in the base operating system code related to the Integrated application server for IBM i as described in the vulnerability details section. The vulnerability exists even when the Integrated application server is not configured or active on the system. IBM i has addressed the vulnerability with a fix as described in the remediation/fixes section.
Vulnerability Details
CVEID: CVE-2023-40375
DESCRIPTION: Integrated application server for IBM i contains a local privilege escalation vulnerability. A malicious actor with command line access to the host operating system can elevate privileges to gain root access to the host operating system.
CVSS Base score: 7.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/263580 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected Products and Versions
| Affected Product(s) | Version(s) |
| IBM i | 7.5 |
| IBM i | 7.4 |
| IBM i | 7.3 |
| IBM i | 7.2 |
Remediation/Fixes
| IBM i Release | 5770-SS1 | PTF Download Link |
| 7.5 | SI84247 | https://www.ibm.com/support/pages/ptf/SI84247 |
| 7.4 | SI84248 | https://www.ibm.com/support/pages/ptf/SI84248 |
| 7.3 | SI84249 | https://www.ibm.com/support/pages/ptf/SI84249 |
| 7.2 | SI84250 | https://www.ibm.com/support/pages/ptf/SI84250 |
https://www.ibm.com/support/fixcentral
Important note: IBM recommends that all users running unsupported versions of affected products upgrade to supported and fixed version of affected products.
For more information on this subject please visit the IBM Website https://www.ibm.com/support/pages/node/7038748
