CVE-2024-52903: IBM Db2 Denial of Service Vulnerability

CVE-2024-52903 Overview

IBM Db2 for Linux, UNIX and Windows versions 12.1.0 and 12.1.1 contain a denial of service vulnerability. A remote, unauthenticated attacker can crash the database server by submitting a specially crafted query. The flaw is tracked under [CWE-248] (Uncaught Exception) and carries a CVSS 3.1 base score of 7.5.

The vulnerability affects Db2 deployments running on Linux, UNIX, and Microsoft Windows. IBM published a security bulletin and patch guidance in the IBM Security Patch Notification.

Critical Impact
An unauthenticated network attacker can trigger a server crash, causing service outage for all database clients and dependent applications.

Affected Products

IBM Db2 for Linux, UNIX and Windows 12.1.0
IBM Db2 for Linux, UNIX and Windows 12.1.1
Deployments across Linux, Microsoft Windows, and UNIX hosts

Discovery Timeline

2025-05-01 - CVE-2024-52903 published to NVD
2025-09-29 - Last updated in NVD database

Technical Details for CVE-2024-52903

Vulnerability Analysis

The vulnerability is a denial of service condition in the IBM Db2 query processing path. When the server receives a specially crafted query, it fails to handle an exception correctly and terminates the database engine process. The CWE-248 classification indicates the root cause is an uncaught exception that propagates beyond intended error-handling boundaries.

The attack requires no authentication, no user interaction, and no special privileges. Any client able to reach the Db2 listener port over the network can submit the malformed query. The impact is limited to availability — confidentiality and integrity are not affected — but a successful crash disconnects every active session and halts downstream applications.

IBM has not published exploit details, and no public proof of concept is available. The EPSS score reflects a low probability of observed exploitation activity in the near term.

Root Cause

The defect is an uncaught exception [CWE-248] triggered during parsing or execution of a specific query pattern. Db2 fails to catch the runtime fault, which propagates and crashes the server process rather than returning a controlled error to the client.

Attack Vector

An attacker connects to the Db2 listener over the network and issues the crafted query through any standard Db2 client interface. The query reaches the SQL engine where the unhandled fault is raised. The server process terminates, dropping all active connections. The attacker can repeat the query to keep the service offline after restart attempts.

No authentication is required by the CVSS vector, but real-world reachability depends on whether the Db2 instance is exposed to untrusted networks or accessible through application-tier query injection paths.

Detection Methods for CVE-2024-52903

Indicators of Compromise

Unexpected db2sysc process crashes or restarts logged in db2diag.log
Repeated client disconnections accompanied by SQL1224N or SQL30081N errors across multiple sessions simultaneously
Core dump files generated in the Db2 instance diagnostic directory without correlating maintenance activity
Inbound query traffic from unauthorized or unexpected source IPs immediately preceding a crash event

Detection Strategies

Monitor db2diag.log for FUNCTION entries reporting trap or signal handlers invoked on the SQL compiler or runtime threads
Correlate database engine restarts with network captures of preceding SQL traffic to identify the triggering query payload
Alert on abnormal frequency of Db2 instance restarts within short time windows

Monitoring Recommendations

Forward Db2 diagnostic logs and operating system process events into a centralized analytics platform such as Singularity Data Lake for correlation with network telemetry
Enable database audit logging to capture the SQL statement immediately preceding any crash event
Track Db2 listener connection metrics and flag sudden mass disconnections that indicate engine termination

How to Mitigate CVE-2024-52903

Immediate Actions Required

Apply the IBM fix pack referenced in the IBM Security Patch Notification to all Db2 12.1.0 and 12.1.1 instances
Inventory all Db2 hosts using configuration management tools and confirm version levels via db2level
Restrict network access to the Db2 listener port so only trusted application servers can reach it

Patch Information

IBM has released a security update addressing CVE-2024-52903 for Db2 12.1.0 and 12.1.1. Refer to the IBM Security Patch Notification for the specific fix pack version, download links, and platform-specific installation instructions. Apply the patch during a scheduled maintenance window and validate connectivity afterward.

Workarounds

Place Db2 listeners behind a network access control list that permits only authenticated application tiers
Enforce least-privilege database accounts so that compromise of an application user does not provide additional query surface
Enable connection rate limiting and idle session timeouts to reduce the impact of repeated crash attempts

bash

# Verify installed Db2 version before and after patching
db2level

# Restrict the Db2 listener to trusted subnets (Linux iptables example)
iptables -A INPUT -p tcp --dport 50000 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 50000 -j DROP