PT-2022-6278 · Ibm · Ibm Aix+1

Christer Oberg · Published 2022-09-12 · Updated 2025-03-29 · CVE-2022-34356

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.1 through 7.3 VIOS version 3.1

Description The issue is related to insufficient access control in the IBM AIX kernel, allowing a non-privileged local user to exploit the vulnerability and obtain root privileges, potentially enabling the execution of arbitrary code.

Recommendations For IBM AIX versions 7.1 through 7.3, update to a version that includes the fix for this issue. For VIOS version 3.1, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the kernel to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2023-00710

CVE-2022-34356

Affected Products

Ibm Aix

Vios

References · 10

• https://ibm.com/support/pages/node/6619721 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-34356 · Security Note
• https://bdu.fstec.ru/vul/2023-00710 · Security Note
• https://osv.dev/vulnerability/CVE-2022-34356 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/230502 · Vendor Advisory
• https://ibm.com/blogs/psirt/security-bulletin-aix-is-vulnerable-to-a-privilege-escalation-vulnerability-cve-2022-34356 · Note
• https://t.me/cibsecurity/49717 · Telegram Post
• https://aix.software.ibm.com/aix/efixes/security/kernel_advisory4.asc · Note
• https://twitter.com/guriguri_dW/status/1905862115535028263 · Twitter Post
• https://twitter.com/guriguri_dW/status/1905862113676980329 · Twitter Post