IBM 4769 Developers Toolkit denial of service

Vulnerability

The vulnerability resides in the IBM 4769 Developers Toolkit, versions 7.0.0 through 7.5.52. It is caused by improper memory allocation of an excessive size (CWE-789), which occurs when the toolkit processes a specially crafted request. No special configuration is required for the code path to be reachable; the flaw is present by default in the affected versions [1].

Exploitation

An attacker with network access to the system running the affected toolkit can trigger the vulnerability remotely. No authentication or user interaction is required. By sending a malicious payload designed to cause an allocation of an excessive size, the attacker can force the Hardware Security Module (HSM) to exhaust memory resources [1].

Impact

A successful exploit results in a denial of service condition against the HSM. The availability of the HSM is fully compromised (CVSS 3.1 base score 7.5, vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Confidentiality and integrity are not affected [1].

Mitigation

IBM has released a fixed version, 7.5.62 or later, to address the vulnerability. Users are advised to obtain the updated toolkit from their provider and upgrade accordingly. No workarounds are available [1].