CVE Alert: CVE-2025-36244 – IBM – AIX

Risk verdict

High risk local privilege escalation on IBM AIX and VIOS when Kerberos authentication is enabled; exploitation is not currently indicated as active, but the impact is severe if triggered.

Why this matters

A local attacker could escalate to root and subvert system integrity, persistence, or data confidentiality on hosts that participate in Kerberos networks. In enterprise environments where Kerberos is deployed across critical services, a single unpatched host could act as a foothold for broader compromise.

Most likely attack path

Exploitation relies on improper initialization of critical variables, enabling a non-privileged local user to write to root-owned files. No user interaction is required, and the attacker must already have local access; PR: NONE (no initial privileges), UI: NONE, AV: LOCAL. The scope is unchanged, so a single host compromise could enable lasting root access and potentially facilitate further intra-host actions or data access.

Who is most exposed

organisations running AIX 7.2/7.3 or VIOS 3.1/4.1 with Kerberos network authentication enabled, particularly on servers hosting databases, middleware, or virtualization layers.

Detection ideas

• Alerts for non-root processes writing to root-owned files or directories.
• Audit logs showing unexpected initialization of critical variables or changes to system configuration by non-privileged users.
• Kerberos-related process initialisation events or overrides in kernel/system logs.
• File integrity monitoring flagging changes to core system files.
• Anomalous attempts to modify root-owned files without elevated privileges.

Mitigation and prioritisation

• Apply the interim fix IJ55344s9a.250722.epkg.Z on AIX 7.2/7.3 and VIOS 3.1/4.1; install prerequisites first; verify SHA256 sums before use; test install in a staging environment.
• Ensure a mksysb backup is available and bootable before patching; follow IBM’s preview/install workflow.
• After patching, reboot if required and revalidate Kerberos configurations; monitor for related anomalies.
• If immediate patching isn’t possible, implement compensating controls: restrict access to affected hosts, tighten Kerberos exposure, and enable enhanced auditing and file integrity monitoring.
• Change-management: schedule downtime, validate prerequisites, and confirm stability post-patch.