CVE-2024-47118: IBM Db2 Denial of Service Vulnerability

CVE-2024-47118 Overview

CVE-2024-47118 affects IBM Db2 for Linux, UNIX, and Windows (LUW), including Db2 Connect Server. A remote, unauthenticated attacker can submit a specially crafted query that causes the database server to crash. The flaw is classified under CWE-121: Stack-based Buffer Overflow and results in a denial of service against the database engine.

The vulnerability impacts availability only, with no confidentiality or integrity loss. Because the attack vector is network-based and requires no privileges or user interaction, any client able to reach the Db2 listener can trigger the condition.

Critical Impact
An unauthenticated attacker can remotely crash IBM Db2 servers with a single malformed query, disrupting database-dependent applications until the instance is restarted.

Affected Products

IBM Db2 for Linux, UNIX, and Windows 10.5.0 through 10.5.11
IBM Db2 for Linux, UNIX, and Windows 11.1.0 through 11.1.4.7, and 11.5.0 through 11.5.9
IBM Db2 for Linux, UNIX, and Windows 12.1.0 through 12.1.3 (includes Db2 Connect Server)

Discovery Timeline

2025-11-07 - CVE-2024-47118 published to the National Vulnerability Database
2025-11-19 - Last updated in NVD database

Technical Details for CVE-2024-47118

Vulnerability Analysis

The vulnerability resides in the Db2 query processing logic. When the server parses a specially crafted SQL query, processing exceeds the bounds of a stack-allocated buffer. The result is a stack-based buffer overflow [CWE-121] that destabilizes the engine and crashes the db2sysc process.

The condition is reachable by any client that can establish a connection to the Db2 listener. Successful exploitation terminates active sessions and interrupts dependent applications until the instance is restarted. Although [CWE-121] flaws can sometimes lead to code execution, IBM characterizes the impact here strictly as denial of service.

All supported Db2 LUW branches are affected, including the Db2 Connect Server distribution used as a gateway to mainframe Db2 environments. Operators running clustered or HADR configurations may still experience cascading session failures when the primary instance terminates.

Root Cause

The root cause is improper bounds validation while handling specific query structures. Untrusted input drives a write past the end of a fixed-size stack buffer inside the SQL processing path. The corrupted stack state triggers an abnormal termination of the Db2 engine process.

Attack Vector

Exploitation is remote and unauthenticated. An attacker sends a crafted SQL query over the Db2 client/server protocol to a reachable instance. No prior session, credentials, or user interaction are required, which makes any internet-exposed or broadly reachable Db2 listener a viable target. See the IBM Support Page for vendor technical details.

No public proof-of-concept exploit, ExploitDB entry, or CISA KEV listing exists for this CVE at the time of writing.

Detection Methods for CVE-2024-47118

Indicators of Compromise

Unexpected termination of the db2sysc process or sudden Db2 instance restarts without administrative action.
Diagnostic entries in db2diag.log referencing trap files, stack dumps, or signal SIGSEGV near SQL parsing routines.
Trap files (t<pid>.<node>.trap.txt) generated in the Db2 diagnostic path immediately after a client query.
Repeated short-lived connections from a single source IP followed by an engine crash event.

Detection Strategies

Monitor Db2 health checks and instance uptime to flag unplanned restarts of db2sysc.
Parse db2diag.log for FUNCTION entries with severity Severe correlated to client query processing.
Inspect network telemetry for anomalous SQL traffic patterns directed at TCP port 50000 or the configured Db2 service port from untrusted networks.

Monitoring Recommendations

Forward Db2 diagnostic logs and trap files to a centralized logging or SIEM platform for correlation with network events.
Alert on any crash of db2sysc outside of approved maintenance windows.
Track inbound connections to Db2 listeners from sources outside expected application tiers.

How to Mitigate CVE-2024-47118

Immediate Actions Required

Apply the fixed Db2 release identified on the IBM Support Page to all affected 10.5, 11.1, 11.5, and 12.1 instances.
Restrict network access to the Db2 listener so only application servers and trusted administrative hosts can reach it.
Inventory all Db2 LUW and Db2 Connect Server deployments, including non-production and disaster-recovery instances, to confirm patch coverage.

Patch Information

IBM has published fixes for the supported branches affected by CVE-2024-47118. Refer to the official IBM Support Page for the specific fix pack versions and download links per branch (10.5.x, 11.1.x, 11.5.x, 12.1.x).

Workarounds

If immediate patching is not possible, place Db2 listeners behind firewall rules or network policies that allow only known application sources.
Use database activity monitoring tools to drop or alert on malformed queries from unauthorized clients.
Enable automated instance restart and HADR failover to reduce downtime if a crash is triggered before patching completes.

bash

# Example: restrict access to the Db2 listener on Linux using iptables
# Replace 10.0.0.0/24 with the trusted application subnet and 50000 with your Db2 port
iptables -A INPUT -p tcp --dport 50000 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 50000 -j DROP

# Verify the currently installed Db2 level before and after patching
db2level