CVE-2024-55898: IBM i Privilege Escalation Vulnerability

CVE-2024-55898 Overview

CVE-2024-55898 is a privilege escalation vulnerability affecting IBM i versions 7.2, 7.3, 7.4, and 7.5. The vulnerability exists due to an unqualified library call that could allow a user with the capability to compile or restore a program to gain elevated privileges. A malicious actor could exploit this flaw to cause user-controlled code to execute with administrator privilege, potentially leading to complete system compromise.

Critical Impact

Users with compile or restore program capabilities can exploit unqualified library calls to execute arbitrary code with administrator privileges, potentially compromising the entire IBM i system.

Affected Products

• IBM i 7.2
• IBM i 7.3
• IBM i 7.4
• IBM i 7.5

Discovery Timeline

• 2025-02-24 - CVE-2024-55898 published to NVD
• 2025-07-03 - Last updated in NVD database

Technical Details for CVE-2024-55898

Vulnerability Analysis

This vulnerability falls under CWE-427 (Uncontrolled Search Path Element), a class of security flaws where an application searches for libraries or executables in an untrusted location that an attacker can control. In the context of IBM i, the unqualified library call mechanism does not properly specify the library path, allowing a malicious actor to inject a trojanized library that gets loaded with elevated privileges.

The attack requires the user to have compile or restore program capabilities on the IBM i system. While this limits the initial attack surface to authenticated users with specific permissions, the ability to escalate to administrator privileges represents a significant security boundary violation.

Root Cause

The root cause of CVE-2024-55898 is an unqualified library call within the IBM i operating system. When a program makes a library call without fully qualifying the library path, the system searches for the library in a sequence of locations defined by the library list. An attacker can place a malicious library in a location that gets searched before the legitimate library, causing the malicious code to be executed instead.

In IBM i environments, the library list search order can be manipulated by users with appropriate permissions, enabling them to hijack legitimate system calls and execute code with the privileges of the calling program—in this case, administrator privileges.

Attack Vector

The attack vector for this vulnerability is network-based, though it requires authenticated access with specific capabilities. The exploitation path involves:

1. An attacker gains authenticated access to an IBM i system with compile or restore program capabilities
2. The attacker creates a malicious library designed to execute attacker-controlled code
3. The attacker places this library in a location that precedes the legitimate library in the search path
4. When a privileged program makes an unqualified library call, the malicious library is loaded
5. The attacker's code executes with administrator privileges

The attack complexity is high as it requires understanding of IBM i library list mechanics and the ability to position malicious code appropriately. However, successful exploitation results in complete privilege escalation to administrator level.

Detection Methods for CVE-2024-55898

Indicators of Compromise

• Unexpected libraries appearing in user-controlled library lists or directories
• Unusual program compilation or restoration activity from non-administrative accounts
• Changes to library list configurations without authorized change management
• Execution of programs with elevated privileges from unexpected library paths

Detection Strategies

• Monitor audit logs for program compilation and restoration activities, particularly from accounts with limited administrative needs
• Implement library list integrity monitoring to detect unauthorized additions or modifications
• Review authority assignments for *SAVSYS and *ALLOBJ special authorities that enable compile/restore capabilities
• Deploy file integrity monitoring on critical system libraries to detect potential library hijacking attempts

Monitoring Recommendations

• Enable and review IBM i Security Audit Journal (QAUDJRN) entries for job-related security events
• Configure alerts for changes to system library lists and user library lists in production environments
• Monitor for unusual patterns of program restoration from backup media or save files
• Implement real-time alerting on privilege escalation indicators within IBM i security logs

How to Mitigate CVE-2024-55898

Immediate Actions Required

• Apply the security patches provided by IBM as documented in the vendor advisory
• Review and restrict user accounts that have compile or restore program capabilities
• Audit library lists to ensure system libraries are properly qualified and protected
• Implement least privilege principles for accounts requiring compile or restore access

Patch Information

IBM has released security updates to address this vulnerability. Administrators should consult the IBM Support Document for detailed patching instructions and PTF (Program Temporary Fix) information specific to their IBM i version. All affected versions (7.2, 7.3, 7.4, and 7.5) should be updated to the latest available maintenance level.

Workarounds

• Restrict compile and restore program authorities to only essential personnel until patches can be applied
• Implement strict library list controls using QSYSLIBL and QUSRLIBL system values
• Configure exit programs to monitor and log library list modifications
• Use product libraries with *LIBL qualification carefully and prefer fully qualified library references where possible

# Review users with compile/restore capabilities
DSPSYSVAL SYSVAL(QSECURITY)
DSPUSRPRF USRPRF(*ALL) TYPE(*BASIC) OUTPUT(*PRINT)

# Check library list configuration
DSPSYSVAL SYSVAL(QSYSLIBL)
DSPSYSVAL SYSVAL(QUSRLIBL)

# Review authority on critical libraries
DSPOBJAUT OBJ(QSYS) OBJTYPE(*LIB)