CVE-2021-20373: IBM Db2 Information Disclosure Vulnerability

CVE-2021-20373 Overview

CVE-2021-20373 is an information disclosure vulnerability affecting IBM Db2 versions 9.7, 10.1, 10.5, 11.1, and 11.5. The LOAD utility fails to enforce directory restrictions under certain circumstances, allowing unauthorized access to file system contents outside intended boundaries. IBM tracks this issue as X-Force ID 199521. The flaw impacts Db2 deployments across multiple operating systems including AIX, HP-UX, Linux, Microsoft Windows, and Oracle Solaris. Attackers exploiting this vulnerability can read sensitive files accessible to the Db2 process, potentially exposing configuration data, credentials, or other confidential information stored on the database server.

Critical Impact
An attacker with network access can leverage the LOAD utility to read files outside permitted directories, exposing sensitive data on systems running affected IBM Db2 versions.

Affected Products

IBM Db2 versions 9.7, 10.1, 10.5, 11.1, and 11.5
IBM AIX, HP-UX, Oracle Solaris
Linux and Microsoft Windows platforms running Db2

Discovery Timeline

2021-12-09 - CVE-2021-20373 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-20373

Vulnerability Analysis

The vulnerability resides in the IBM Db2 LOAD utility, which is used to bulk load data into database tables from external files. The utility is expected to enforce directory restrictions that limit which file system paths a user can reference during a LOAD operation. Under specific conditions, these restrictions are not applied correctly, permitting access to files outside the authorized directory scope.

This is classified as an information disclosure issue [NVD-CWE-noinfo]. The confidentiality impact is high, while integrity and availability are unaffected. The LOAD utility executes with elevated database service privileges, so files readable by the Db2 instance owner become exposed regardless of the requesting user's operating system permissions.

The issue affects all major operating systems Db2 supports, indicating the flaw exists in cross-platform Db2 code rather than in OS-specific integrations.

Root Cause

The root cause is improper enforcement of directory restrictions within the LOAD utility's file path handling logic. The utility accepts file path inputs but does not consistently validate that resolved paths remain within authorized directories, enabling a path traversal-style information disclosure.

Attack Vector

The attack vector is network-based with low complexity and requires no user interaction. An authenticated database user invokes the LOAD utility specifying a file path outside the intended directory boundary. Because the utility skips the expected directory restriction check under specific conditions, the file contents are read by the Db2 process and exposed to the attacker.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The vulnerability is documented in the IBM X-Force Vulnerability #195521 database and the IBM Support advisory.

Detection Methods for CVE-2021-20373

Indicators of Compromise

Unexpected LOAD utility invocations referencing file paths outside standard data directories
Db2 diagnostic logs (db2diag.log) showing LOAD operations against unusual or system file paths
Audit records of users running LOAD commands with absolute paths to sensitive locations such as /etc, /home, or Windows system directories

Detection Strategies

Enable Db2 audit facility (db2audit) and review the EXECUTE and OBJMAINT categories for LOAD utility activity
Monitor file access patterns of the Db2 instance owner account for reads outside expected database storage paths
Correlate database session activity with operating system file access events to identify abnormal LOAD source file references

Monitoring Recommendations

Track LOAD utility usage frequency and source file paths to baseline normal behavior
Alert on LOAD operations executed by accounts that do not normally perform bulk data ingestion
Forward Db2 audit logs to a centralized logging platform for correlation with endpoint and network telemetry

How to Mitigate CVE-2021-20373

Immediate Actions Required

Apply the IBM Db2 security fix referenced in the IBM Support advisory for your installed version
Inventory all Db2 deployments to confirm version levels across affected releases 9.7, 10.1, 10.5, 11.1, and 11.5
Restrict LOAD authority to a minimal set of trusted database administrators using Db2 authorization controls
Review the NetApp Security Advisory NTAP-20220225-0005 if running Db2 on NetApp-integrated infrastructure

Patch Information

IBM has released fixes for affected Db2 versions. Refer to the IBM Support page for the appropriate fix pack or special build for your release. Apply the corresponding fix pack on each Db2 instance and restart the database manager to activate the changes.

Workarounds

Revoke the LOAD authority from non-essential users and roles until patches are applied
Configure operating system file permissions to limit the Db2 instance owner's read access to only required directories
Place Db2 data and load source directories on dedicated file systems isolated from sensitive system files

bash

# Example: Revoke LOAD authority from a user in Db2
db2 connect to SAMPLEDB
db2 "REVOKE LOAD ON DATABASE FROM USER appuser"
db2 "GRANT LOAD ON DATABASE TO USER dbadmin"
db2 terminate