CVE-2024-25021: IBM VIOS Perl RCE Vulnerability

CVE-2024-25021 Overview

CVE-2024-25021 affects the Perl implementation shipped with IBM AIX 7.3 and IBM Virtual I/O Server (VIOS) 4.1. A non-privileged local user can leverage the flaw to execute arbitrary commands on the affected system. IBM tracks the issue internally as X-Force ID 281320. The weakness is categorized under [CWE-114] Process Control, which covers scenarios where a program loads external code or commands from an untrusted source. Because AIX and VIOS are widely deployed on IBM Power Systems in enterprise data centers, exploitation could impact confidentiality, integrity, and availability of critical workloads.

Critical Impact
A local, unauthenticated attacker can execute arbitrary commands in the context of a higher-privileged process, leading to full compromise of the affected AIX or VIOS host.

Affected Products

IBM AIX 7.3
IBM VIOS 4.1
IBM Power Systems running the impacted Perl distribution

Discovery Timeline

2024-02-22 - CVE-2024-25021 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-25021

Vulnerability Analysis

The vulnerability resides in the Perl interpreter distributed with IBM AIX 7.3 and VIOS 4.1. Perl on these platforms improperly handles process control inputs used to locate modules or execute helper commands. A local, non-privileged user can influence this behavior to execute arbitrary commands under the privileges of a Perl process invoked by another user or a privileged service. The result is local code execution with high impact to confidentiality, integrity, and availability of the host.

Root Cause

The root cause aligns with [CWE-114] Process Control. Perl loads or invokes external resources without adequately validating the sources it consults. When a low-privileged user controls attacker-writable paths or environment inputs consumed by a privileged Perl invocation, that user can insert code or commands that Perl then executes. IBM has not released the full technical description publicly; refer to the IBM X-Force Vulnerability #281320 entry for vendor details.

Attack Vector

Exploitation requires local access to an affected AIX 7.3 or VIOS 4.1 host. No prior authentication to the Perl process itself is required, and no user interaction is needed. The attacker prepares a malicious module, script, or environment condition, then waits for or triggers a Perl invocation that consumes it. Because IBM has not published proof-of-concept code, a sanitized exploit example is not provided here. Consult the IBM Support Patch Node #7122628 advisory for authoritative remediation guidance.

Detection Methods for CVE-2024-25021

Indicators of Compromise

Unexpected Perl child processes spawned by system daemons or privileged users on AIX 7.3 or VIOS 4.1.
Creation or modification of Perl modules (.pm files) in world-writable directories or user-controlled paths later consulted by privileged Perl processes.
Anomalous shell commands executed under root or padmin on VIOS following Perl invocation.

Detection Strategies

Audit Perl @INC directories on AIX and VIOS hosts and alert on writable paths that appear in the module search order for privileged users.
Correlate process telemetry to identify Perl scripts invoked by root that load modules from non-standard locations.
Monitor system logs (syslog, errpt) for unusual privilege transitions immediately following Perl execution.

Monitoring Recommendations

Enable AIX Audit subsystem to capture PROC_Execute and FILE_Open events involving /usr/bin/perl and referenced module paths.
Forward AIX and VIOS audit records to a centralized analytics platform for behavioral correlation across hosts.
Baseline expected Perl usage on VIOS partitions and alert on deviations, since VIOS scripts are typically limited to management tasks.

How to Mitigate CVE-2024-25021

Immediate Actions Required

Apply the IBM-supplied fix referenced in the IBM Support Patch Node #7122628 advisory to AIX 7.3 and VIOS 4.1 systems.
Inventory all Power Systems LPARs running AIX 7.3 or VIOS 4.1 and prioritize hosts that allow interactive local logins.
Restrict shell and Perl interpreter access for non-administrative accounts until patches are deployed.

Patch Information

IBM has published fixes and interim mitigations through the official advisory at IBM Support Patch Node #7122628. Administrators should download the appropriate iFix for their AIX 7.3 technology level or VIOS 4.1 build and apply it using emgr -e on AIX or updateios on VIOS. Validate integrity of the iFix package before installation and follow IBM guidance for rebooting affected partitions.

Workarounds

Remove world-writable directories from the Perl @INC search path and ensure PERL5LIB and PERL5OPT are not exported by shared profiles.
Restrict execute permissions on /usr/bin/perl to administrative groups on hosts where interactive Perl use is not required.
Disable or constrain unnecessary local user accounts on VIOS partitions, since VIOS is intended for virtualization administration only.

bash

# Example: apply an IBM iFix on AIX and verify installation
emgr -e /path/to/IJxxxxx.240101.epkg.Z
emgr -l | grep -i IJxxxxx

# Example: audit Perl module search path for writable directories
perl -e 'for (@INC) { print "$_\n" if -w $_ }'