CVE-2021-38931: IBM Db2 Information Disclosure Flaw

CVE-2021-38931 Overview

IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) versions 11.1 and 11.5 is vulnerable to an information disclosure vulnerability that allows a connected user to have indirect read access to a table where they are not authorized to select from. This access control bypass enables authenticated users to retrieve sensitive data from database tables beyond their intended permissions.

Critical Impact

Authenticated users can bypass authorization controls to indirectly read data from tables they should not have access to, potentially exposing sensitive business data, credentials, or personally identifiable information stored in the database.

Affected Products

• IBM Db2 11.1 (Linux, UNIX, Windows)
• IBM Db2 11.5 (Linux, UNIX, Windows)
• IBM DB2 Connect Server 11.1 and 11.5
• NetApp OnCommand Insight (uses affected Db2 versions)

Discovery Timeline

• 2021-12-09 - CVE-2021-38931 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-38931

Vulnerability Analysis

This vulnerability is classified under CWE-668 (Exposure of Resource to Wrong Sphere), which describes scenarios where a resource is exposed to actors that should not have access to it. In IBM Db2, the authorization framework failed to properly restrict indirect data access paths, allowing authenticated but unauthorized users to read table contents through alternative query mechanisms.

The vulnerability affects the database's access control enforcement layer, which should verify authorization for all data access paths. However, certain indirect access methods bypass the standard SELECT privilege checks, enabling data retrieval without the proper table-level permissions. This represents a significant gap in the defense-in-depth approach typically expected in enterprise database systems.

Root Cause

The root cause stems from improper access control validation in IBM Db2's query execution pipeline. While direct SELECT statements against tables properly enforce authorization checks, certain indirect access methods—such as through views, stored procedures, or internal database operations—fail to validate that the requesting user has appropriate privileges on the underlying base tables.

This design flaw allows authenticated users to construct queries or leverage database features that indirectly reference tables, bypassing the intended authorization barriers. The authorization subsystem does not consistently apply privilege verification across all potential data access paths.

Attack Vector

An attacker with valid database credentials (low privilege authenticated user) can exploit this vulnerability over the network without any user interaction. The exploitation requires:

1. Valid authentication credentials to connect to the Db2 instance
2. Knowledge of table names or schema structure within the database
3. Ability to execute queries or database operations that trigger indirect access paths

The attack can be conducted remotely against any network-accessible Db2 instance running the vulnerable versions. Since no special privileges beyond basic database connectivity are required, any authenticated user—including application service accounts or low-privilege database users—could potentially exploit this vulnerability to access unauthorized data.

Detection Methods for CVE-2021-38931

Indicators of Compromise

• Unusual query patterns from user accounts accessing tables outside their normal scope
• Database audit logs showing data access to sensitive tables by unauthorized user accounts
• Anomalous data retrieval operations that bypass normal application data access paths
• Increased query activity targeting system catalog tables or metadata

Detection Strategies

• Enable comprehensive Db2 audit logging to capture all data access events, including indirect table references
• Implement database activity monitoring (DAM) solutions to detect unauthorized data access patterns
• Configure alerts for queries that access tables where the executing user lacks explicit SELECT privileges
• Review connection logs for unusual access patterns from service accounts or low-privilege users

Monitoring Recommendations

• Deploy SentinelOne Singularity to monitor database server endpoints for suspicious process behavior and data exfiltration attempts
• Establish baseline query patterns for each user and alert on deviations indicating potential exploitation
• Monitor network traffic to Db2 instances for anomalous data transfer volumes
• Implement periodic reviews of user privilege assignments against actual data access patterns

How to Mitigate CVE-2021-38931

Immediate Actions Required

• Apply the latest IBM Db2 security patches from IBM Support immediately
• Review and audit all user privileges to ensure principle of least privilege is enforced
• Enable enhanced audit logging to detect potential exploitation attempts
• Restrict network access to Db2 instances to only required systems and users

Patch Information

IBM has released security updates addressing this vulnerability. Administrators should consult the IBM Support Page for specific fix pack versions and installation instructions. NetApp customers using OnCommand Insight should also review the NetApp Security Advisory NTAP-20220114-0001 for guidance on affected deployments.

The fix enforces consistent authorization checks across all data access paths, ensuring that indirect table references properly validate user privileges before returning data.

Workarounds

• Implement strict network segmentation to limit Db2 access to trusted hosts only
• Review and remove unnecessary user accounts and privileges from production databases
• Use database views with explicit security contexts to control data access where possible
• Deploy application-layer access controls as an additional authorization layer

# Example: Review user privileges on sensitive tables
db2 "SELECT GRANTEE, GRANTEETYPE, PRIVILEGE FROM SYSCAT.TABAUTH WHERE TABNAME='SENSITIVE_TABLE' ORDER BY GRANTEE"

# Enable audit logging for data access events
db2audit configure scope all status both
db2audit start