CVE-2024-22346: 
NixOS vulnerability analysis and mitigation

CVE-2024-22346 is a privilege elevation vulnerability affecting Db2 for IBM i versions 7.2, 7.3, 7.4, and 7.5. The vulnerability was discovered and disclosed by IBM, with initial publication on March 14, 2024. The vulnerability stems from an unqualified library call in the Db2 for IBM i infrastructure that could allow local users to gain elevated privileges (IBM Advisory, NVD).

The vulnerability is caused by an unqualified library call in the Db2 for IBM i infrastructure. It has been assigned a CVSS v3.1 base score of 7.8 (High) by NVD with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating local access, low attack complexity, low privileges required, no user interaction, and high impacts on confidentiality, integrity, and availability. IBM's assessment gives it a slightly higher CVSS score of 8.4 with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

A successful exploitation of this vulnerability could allow a malicious actor to cause user-controlled code to run with administrator privileges. This represents a significant security risk as it could lead to complete system compromise through privilege elevation (IBM Advisory).

The vulnerability requires local access to the system for exploitation. No user interaction is needed, and depending on the assessment (NVD vs IBM), either low or no privileges are required to exploit the vulnerability (NVD).

IBM has released fixes for all affected versions through PTFs. For IBM i 7.5, users should apply SF99950 (750 Db2 for IBM i Level 6), for 7.4 apply SF99704 (740 Db2 for IBM i Level 27), and for 7.3 and 7.2, multiple individual PTFs are available. No workarounds have been provided, making patch installation the only mitigation option (IBM Advisory).