Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to obtain ownership of arbitrary file system objects due to a time-of-check to time-of-use (TOCTOU) race condition.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.0",
  "pubDate": "2026-09-14T21:17:04.217Z",
  "pubdate": "2026-09-14T21:17:04.217Z",
  "executiveSummary": "A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in IBM i versions 7.3, 7.4, 7.5, and 7.6, which may allow a local attacker to obtain unauthorized ownership of arbitrary file system objects.\nThe vulnerability resides in the way the file system handles object access, leading to a critical privilege escalation risk.\nAn authenticated local attacker could exploit this flaw to manipulate file ownership, effectively gaining control over sensitive data or system files.\nSuccessful exploitation requires local access to the system and precise timing to intercept the race condition between the security check and the subsequent file operation.\nThe impact includes full administrative or unauthorized control over file system objects, potentially compromising system integrity, confidentiality, and availability.\nOrganizations using the specified versions of IBM i are at risk and should prioritize monitoring and applying updates provided by the vendor.",
  "technicalDetails": "The vulnerability is rooted in a TOCTOU race condition inherent in the IBM i file system management subsystem. A TOCTOU flaw occurs when a system checks the state of a resource—such as the permissions or status of a file—and subsequently performs an action based on that check, without ensuring the state remains consistent between the two operations.\nIn this specific IBM i implementation, the security validation mechanism is separated from the execution phase of file object ownership changes. An attacker can leverage this window of opportunity by replacing a target file or a symbolic link with an attacker-controlled object after the validation routine has completed but before the ownership update function is actually committed.\nThe attack flow proceeds as follows: First, the attacker identifies a target object where the system performs a privileged operation. Second, the attacker initiates a request that forces the system to validate access to a benign object. Third, through rapid, iterative execution—often facilitated by shell scripts or automated race condition exploits—the attacker replaces the benign object with a sensitive system file or a symbolic link pointing to a critical system object during the narrow temporal gap between the validation (time-of-check) and the application of ownership changes (time-of-use).\nBecause the system trusts the result of the initial check, it proceeds to modify the ownership of the now-substituted target object as if it were the original benign object, granting the attacker ownership of arbitrary files. This elevates the attacker's privileges, allowing them to manipulate system configuration files, read private user data, or replace executables with malicious code.\nThe vulnerability affects IBM i 7.3, 7.4, 7.5, and 7.6. Exploitation requires local authentication and standard user privileges on the system, with no network exposure required for the initial trigger. The post-exploitation impact allows for total bypass of standard object security controls, enabling persistence or further privilege escalation within the IBM i environment."
}