Description

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a local attacker to obtain information due to a race condition involving a predictable Unix domain socket path in a world-writable directory.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.4",
  "pubDate": "2026-09-04T16:17:20.970Z",
  "pubdate": "2026-09-04T16:17:20.970Z",
  "executiveSummary": "IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 are susceptible to an information disclosure vulnerability stemming from a race condition.\nThe vulnerability arises due to the use of a predictable Unix domain socket path located within a world-writable directory.\nA local attacker with low-level privileges can exploit this race condition to intercept or manipulate sensitive communication handled by the affected component.\nThe impact includes the potential unauthorized access to sensitive information transmitted over the socket.\nSuccessful exploitation requires local access to the system and precise timing to win the race condition during the socket creation process.\nThis vulnerability highlights a flaw in secure inter-process communication (IPC) implementation, potentially leading to a breach of data confidentiality.",
  "technicalDetails": "The vulnerability is rooted in the insecure implementation of inter-process communication (IPC) using Unix domain sockets within IBM Db2 Mirror for i.\nThe root cause is the utilization of a hardcoded or predictable file system path for the Unix domain socket endpoint, which is explicitly placed within a directory possessing world-writable permissions (e.g., /tmp or a similarly unrestricted directory).\nIn Unix-like environments, a world-writable directory allows any local user to create, delete, or rename files within that directory. When a service attempts to bind a Unix domain socket to a predictable path in such a location, it creates a race condition vulnerability.\nThe attack flow proceeds as follows: 1. The attacker monitors the target directory for the creation of the expected socket file or prepares the environment by pre-creating a symbolic link or a file at the predictable path before the legitimate service initializes. 2. Upon service startup or socket re-initialization, the attacker attempts to 'win' the race by creating their own socket or file at the designated location before the legitimate process binds its socket. 3. If the attacker successfully positions their own entity at the path, they may intercept traffic intended for the legitimate process, effectively performing a man-in-the-middle (MITM) attack at the IPC level, or force the legitimate service to write sensitive data to an attacker-controlled file descriptor.\nBecause the vulnerability involves the filesystem namespace, the exploit is limited to local users who have the ability to traverse the directory structure. No network exposure is required to initiate the attack; however, the data intercepted could contain sensitive authentication tokens or administrative telemetry.\nThe predictable nature of the socket path removes the necessity for the attacker to brute-force or guess locations, significantly lowering the complexity of the exploit. Post-exploitation impact is primarily defined by the sensitivity of the information transmitted through the hijacked socket, which may lead to further system compromise or escalation of privilege if credentials are exposed in the intercepted stream."
}