CVE-2024-38330: IBM i Privilege Escalation Vulnerability

CVE-2024-38330 Overview

CVE-2024-38330 is a local privilege escalation vulnerability affecting IBM System Management for i versions 7.2, 7.3, and 7.4. The flaw stems from an unqualified library program call, classified under [CWE-427] Uncontrolled Search Path Element. A local user can leverage the unqualified reference to inject a malicious program into the library search path. Once loaded, the attacker-controlled code executes with administrator privilege on the IBM i system. IBM tracks this issue under X-Force ID 295227.

Critical Impact
Local attackers can execute arbitrary code with administrator privileges on affected IBM i systems, compromising confidentiality, integrity, and availability of the host.

Affected Products

IBM i 7.2
IBM i 7.3
IBM i 7.4

Discovery Timeline

2024-07-08 - CVE-2024-38330 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-38330

Vulnerability Analysis

The vulnerability resides in IBM System Management for i, a component used to administer IBM i (formerly OS/400) environments. Affected programs call library programs without qualifying the target library. On IBM i, when a program is referenced without a fully qualified library name, the system searches the job's library list to locate the object. An attacker who can influence the library list, or place a same-named object in a library that appears earlier in the search order, causes the malicious object to be resolved and executed instead of the intended IBM program.

Because the vulnerable IBM System Management for i programs run under elevated authority, the substituted code inherits administrator privilege. Exploitation requires local access and user interaction, as reflected by the attack vector characteristics reported by IBM.

Root Cause

The root cause is an unqualified program call within IBM System Management for i. The calling code omits the explicit library specification, forcing resolution through the job's library list. This is a canonical [CWE-427] Uncontrolled Search Path Element weakness. Any user with authority to create objects in a library ahead of the intended library on the search path can hijack the call.

Attack Vector

An attacker with local, low-privileged access to the IBM i system creates a program object matching the unqualified name expected by the vulnerable IBM component. The attacker places this object in a library present earlier in the library list than the legitimate IBM library. When an administrator or automated task invokes the affected System Management for i function, the system resolves the call to the attacker's object and executes it with administrator authority. The EPSS score is 0.258% with a percentile of 17.594.

No verified public exploit code is available. See the IBM X-Force Vulnerability #295227 entry for technical details.

Detection Methods for CVE-2024-38330

Indicators of Compromise

Unexpected program or command objects with names matching IBM System Management for i internal calls, created in user libraries or libraries appearing early in QUSRLIBL or QSYSLIBL.
Job logs showing program resolution from non-IBM libraries during administrative operations.
New or modified objects in libraries owned by non-administrative user profiles that adopt authority.

Detection Strategies

Audit the system library list (QSYSLIBL) and user library lists (QUSRLIBL) for unauthorized libraries preceding IBM system libraries.
Review QAUDJRN audit journal entries for object creation (CO) and authority changes (CA) tied to program objects in user-writable libraries.
Correlate program invocations from administrative jobs against expected IBM library sources.

Monitoring Recommendations

Enable IBM i security auditing with QAUDLVL values that capture program adoption and object access events.
Forward QAUDJRN events to a centralized log platform for continuous review of library list manipulation.
Alert on creation of *PGM objects in libraries that also appear in privileged users' library lists.

How to Mitigate CVE-2024-38330

Immediate Actions Required

Apply the fixes published by IBM in the IBM Support advisory (node/7159615) for IBM i 7.2, 7.3, and 7.4.
Restrict *ALLOBJ and *CHANGE authority on libraries referenced by IBM System Management for i.
Review and lock down library list configuration to prevent user-controlled libraries from preceding IBM system libraries.

Patch Information

IBM has released PTFs addressing CVE-2024-38330 for IBM i 7.2, 7.3, and 7.4. Refer to the IBM Support Page for Advisory #7159615 for the specific PTF identifiers and installation instructions applicable to each release.

Workarounds

Remove write and create authority to any library that appears in system or user library lists ahead of IBM-supplied libraries.
Enforce qualified program calls in operator procedures and CL programs invoking System Management for i functions.
Limit interactive and batch access on affected systems to trusted administrators until PTFs are applied.

bash

# Configuration example: review library list ordering on IBM i
DSPSYSVAL SYSVAL(QSYSLIBL)
DSPSYSVAL SYSVAL(QUSRLIBL)
# Restrict authority on a library referenced by unqualified calls
GRTOBJAUT OBJ(QSYS/TARGETLIB) OBJTYPE(*LIB) USER(*PUBLIC) AUT(*USE)
RVKOBJAUT OBJ(QSYS/TARGETLIB) OBJTYPE(*LIB) USER(*PUBLIC) AUT(*CHANGE)