CVE-2024-31919: IBM MQ Denial of Service Vulnerability

CVE-2024-31919 Overview

CVE-2024-31919 is a denial of service vulnerability affecting multiple versions of IBM MQ. The flaw resides in the message processing logic when an API Exit uses the MQBUFMH function to convert a buffer into a message handle. A remote, unauthenticated attacker can send specially crafted messages that trigger an error condition, causing the affected queue manager to stop processing messages. IBM tracks this issue as X-Force ID 290259, and it is classified under [CWE-770: Allocation of Resources Without Limits or Throttling]. The vulnerability only manifests in configurations that load an API Exit invoking MQBUFMH.

Critical Impact
Remote attackers can disrupt message queue availability without authentication, breaking message-driven business workflows that rely on IBM MQ.

Affected Products

IBM MQ 9.0 LTS
IBM MQ 9.1 LTS
IBM MQ 9.2 LTS
IBM MQ 9.3 LTS and 9.3 CD

Discovery Timeline

2024-06-28 - CVE-2024-31919 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-31919

Vulnerability Analysis

The vulnerability stems from improper error handling inside the IBM MQ message processing path. When an API Exit is loaded into the queue manager and invokes the MQBUFMH (Message Buffer to Message Handle) call, a malformed or unexpected message structure triggers an error that the runtime does not recover from cleanly. The result is service disruption to the queue manager handling the message. Because IBM MQ is widely deployed as a backbone for financial transactions, mainframe integration, and enterprise application messaging, loss of availability cascades into dependent business systems. The vulnerability impacts confidentiality and integrity at no level, but availability impact is high.

Root Cause

The root cause is unbounded or unsafe resource handling within the MQBUFMH processing routine when invoked from an API Exit. IBM has not published exhaustive internals, but the CWE-770 classification indicates that the affected code path fails to limit or throttle resource consumption when handling crafted message buffers. Environments without an API Exit using MQBUFMH are not exposed.

Attack Vector

The attack is network-reachable and requires no authentication or user interaction. An attacker who can reach the MQ listener and submit a message that flows through the affected API Exit can trigger the error condition. Exploitation requires a vulnerable configuration: a customer-deployed or third-party API Exit invoking MQBUFMH must be active on the queue manager.

No public proof-of-concept code is currently available. The vulnerability manifests within the MQ runtime message handle conversion path. See the IBM Security Patch Advisory and IBM X-Force Vulnerability #290259 for vendor technical details.

Detection Methods for CVE-2024-31919

Indicators of Compromise

Unexpected termination or restart cycles of the IBM MQ queue manager process (amqzxma0, runmqlsr).
FDC (First Failure Data Capture) files generated in /var/mqm/errors/ referencing MQBUFMH or API Exit failures.
Queue manager error logs (AMQERR01.LOG) showing recurring abnormal termination messages following inbound traffic.
Sudden drop in MQ message throughput correlated with inbound connections from untrusted sources.

Detection Strategies

Monitor MQ error logs for AMQ series messages indicating API Exit failures or handle conversion errors.
Correlate queue manager restarts with network connection logs to identify suspicious source addresses.
Inventory all queue managers and identify which ones load API Exits using MQBUFMH to scope exposure.
Inspect channel authentication records (CHLAUTH) for unauthorized client connections preceding outages.

Monitoring Recommendations

Forward MQ error logs and FDC files into a centralized logging or SIEM platform for correlation and alerting.
Configure availability alarms on queue manager status (dspmq -o status) to detect outages quickly.
Track message rate baselines per channel to surface anomalies preceding crash events.
Alert on creation of new FDC files in /var/mqm/errors/ as a high-signal indicator of runtime faults.

How to Mitigate CVE-2024-31919

Immediate Actions Required

Apply the IBM-provided fix packs referenced in the IBM Security Patch Advisory to all affected queue managers.
Identify queue managers loading API Exits that call MQBUFMH and prioritize them for patching.
Restrict network access to MQ listener ports (default 1414/tcp) using firewall rules and segmentation.
Enforce strict channel authentication using CHLAUTH rules and TLS-secured channels.

Patch Information

IBM has released fix packs for IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS, and 9.3 CD. Refer to the IBM Security Patch Advisory for the exact fix pack versions and download instructions for each release stream. Patching is the only complete remediation.

Workarounds

Temporarily disable any API Exit that invokes MQBUFMH until patches are applied, if business processes permit.
Restrict inbound MQ connectivity to known, authenticated client hosts only via CHLAUTH SET rules.
Enable TLS on all SVRCONN and cluster channels to prevent untrusted clients from delivering crafted messages.
Place queue managers behind network access controls so listener ports are not exposed to untrusted networks.

bash

# Example CHLAUTH rule to restrict client connections to trusted IP ranges
runmqsc QM1 <<EOF
SET CHLAUTH('SYSTEM.DEF.SVRCONN') TYPE(ADDRESSMAP) ADDRESS('10.10.0.*') USERSRC(CHANNEL) ACTION(REPLACE)
SET CHLAUTH('*') TYPE(ADDRESSMAP) ADDRESS('*') USERSRC(NOACCESS) ACTION(REPLACE)
REFRESH SECURITY TYPE(CONNAUTH)
EOF