CVE-2024-49350: IBM Db2 Denial of Service Vulnerability

CVE-2024-49350 Overview

CVE-2024-49350 is a denial of service vulnerability affecting IBM Db2 for Linux, UNIX and Windows, including DB2 Connect Server. A remote attacker can crash the database server by submitting a specially crafted query that triggers memory corruption within the query processing engine. The flaw is rooted in stack-based buffer overflow [CWE-121] and out-of-bounds write [CWE-787] conditions. Affected releases span 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.1. IBM has published an advisory and remediation guidance for customers running supported Db2 versions.

Critical Impact
A network-reachable attacker without authentication can crash the Db2 server, disrupting database availability for all dependent applications.

Affected Products

IBM Db2 for Linux, UNIX and Windows 11.1.0 through 11.1.4.7
IBM Db2 for Linux, UNIX and Windows 11.5.0 through 11.5.9
IBM Db2 for Linux, UNIX and Windows (and DB2 Connect Server) 12.1.0 through 12.1.1

Discovery Timeline

2025-05-29 - CVE-2024-49350 published to NVD
2025-06-09 - Last updated in NVD database

Technical Details for CVE-2024-49350

Vulnerability Analysis

The vulnerability resides in the Db2 query processing path. When the server parses or evaluates a specially crafted query, internal handling writes beyond the bounds of a stack-allocated buffer. The condition maps to two related weaknesses: stack-based buffer overflow [CWE-121] and out-of-bounds write [CWE-787]. The corruption causes the database engine process to terminate, producing a denial of service. Confidentiality and integrity are not affected based on the IBM advisory, but availability impact is high. The attack requires no authentication and no user interaction, and it can be delivered over any network channel that exposes the Db2 service.

Root Cause

The root cause is missing or insufficient bounds checking during query structure processing. Attacker-controlled input within a SQL statement reaches a fixed-size stack buffer without proper length validation. The resulting write overruns the buffer and corrupts adjacent stack data, including saved control values, which forces the server process to abort.

Attack Vector

An unauthenticated remote attacker who can reach the Db2 listener submits a crafted SQL query. Because the trigger occurs during server-side query handling, any client path that delivers SQL to the engine is sufficient. Successful exploitation crashes the Db2 instance and interrupts service for all connected applications. The EPSS score is 0.209% at the 43.264 percentile, indicating low predicted exploitation activity at this time. No public proof-of-concept is currently available. Refer to the IBM Security Node Advisory for technical details and fix levels.

Detection Methods for CVE-2024-49350

Indicators of Compromise

Unexpected Db2 instance termination or db2sysc process crashes accompanied by FODC (First Occurrence Data Capture) directories under the diagnostic path.
Trap entries and stack traceback files in the db2diag.log referencing query compilation or runtime components.
Sudden loss of client connectivity and connection reset errors reported by application servers querying Db2.

Detection Strategies

Monitor db2diag.log for repeated trap events, signal SIGSEGV records, or panic messages tied to query execution.
Correlate database service restarts with inbound SQL traffic patterns from untrusted sources to identify probable exploit attempts.
Inspect network captures or database audit logs for malformed or unusually large SQL statements preceding crashes.

Monitoring Recommendations

Enable Db2 audit facility (db2audit) to capture statement-level activity, including source IP and authentication ID.
Forward Db2 diagnostic logs and operating system service-control events to a centralized SIEM for crash-loop alerting.
Track instance uptime and restart counters as a baseline metric, alerting on deviations within short time windows.

How to Mitigate CVE-2024-49350

Immediate Actions Required

Apply the fix pack or special build identified in the IBM advisory for your installed Db2 release branch.
Restrict network exposure of the Db2 listener (default TCP 50000) to trusted application subnets using firewall rules.
Enforce authentication and least-privilege access for all database accounts and review accounts with broad SQL execution rights.

Patch Information

IBM has issued fixes for the affected branches. Customers on 11.1.x should move to a fixed 11.1.4.7 special build, customers on 11.5.x should upgrade to the fixed level beyond 11.5.9, and customers on 12.1.x should upgrade past 12.1.1. Consult the IBM Security Node Advisory for the exact fix pack identifiers and download locations.

Workarounds

Place Db2 behind a database firewall or proxy that inspects and rejects malformed SQL constructs.
Disable direct external access to the Db2 instance and route client traffic through authenticated middleware tiers.
Increase monitoring of instance health and configure automatic restart with rate limits to detect repeated crash attempts.

bash

# Configuration example: restrict Db2 listener to trusted subnet (Linux iptables)
iptables -A INPUT -p tcp --dport 50000 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 50000 -j DROP

# Verify installed Db2 level after patching
db2level