Description

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 IBM i could allow a local attacker to delete historical flight-recorder archives due to improper access control in an SQL procedure.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-04T17:16:54.777Z",
  "pubdate": "2026-09-04T17:16:54.777Z",
  "executiveSummary": "This vulnerability involves improper access control within an SQL procedure in IBM Db2 Mirror for i, specifically affecting versions 7.4, 7.5, and 7.6. The flaw permits a local attacker to perform unauthorized deletion of historical flight-recorder archives.\nThe vulnerability is classified as an improper access control issue, where the SQL procedure fails to enforce sufficient authorization checks during the execution of file management operations. By exploiting this gap, a local user can bypass standard security constraints to target system diagnostic data.\nThe impact of this vulnerability is primarily focused on the loss of auditability and diagnostic capability, as the removal of flight-recorder archives hinders incident response and system forensics. This capability is restricted to local attackers who already possess access to the IBM i environment, meaning they do not necessarily require remote network access to execute the exploit.\nWhile the vulnerability does not directly grant remote execution, the ability to destroy historical forensic logs can be leveraged by an attacker to cover their tracks after gaining unauthorized access to the system. Risk implications are moderate, centering on the compromise of operational integrity and forensic reliability.",
  "technicalDetails": "The root cause of the vulnerability resides in the implementation of an SQL procedure within the IBM Db2 Mirror for i component. The logic governing the management of flight-recorder archives fails to properly validate the calling user's permissions before invoking underlying system functions that execute filesystem deletion commands. Consequently, the procedure operates with a privilege level higher than that which should be permitted for standard local users, resulting in an authorization bypass.\nExploitation requires a local attacker to have interactive access to the IBM i environment. The attack flow begins with the attacker identifying the specific SQL procedure responsible for interacting with the flight-recorder archive repository. Because the procedure lacks strict internal access control checks, the attacker can execute the procedure directly via SQL interfaces—such as Run SQL Scripts or the database engine's command-line interface—to trigger the deletion process.\nThe affected components are the specific SQL-based stored procedures integrated into the IBM Db2 Mirror for i framework that interact with historical log files. Because these procedures are built into the product's administrative suite, they may be executable by any user with basic SQL access if the objects themselves have broad execute permissions inherited from the system profile.\nThe exploitation method involves crafting an SQL call that directs the target procedure to target sensitive archive paths that the user would not normally have the OS-level authority to modify. When the procedure is executed, it runs with the authority of the procedure owner, effectively escalating the attacker's ability to manipulate file system contents. This bypasses the object-level security typically enforced by the IBM i security model, as the procedure effectively acts as an ambient-authority mechanism.\nPost-exploitation, the attacker successfully removes historical flight-recorder archives. The primary impact is the loss of diagnostic data, which is critical for debugging complex Db2 Mirror synchronization issues or investigating unauthorized activities within the database cluster. By destroying these records, an attacker significantly degrades the administrative team's ability to reconstruct the timeline of prior malicious actions, thereby impeding incident response efforts and forensic auditing."
}