Privilege escalation in IBM VIOS and IBM AIX - CVE-2016-3053

Vulnerability identifier: #VU1022

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-3053

CWE-ID: CWE-264

Exploitation vector: Local access

Exploit availability: Public exploit is available

The vulnerability allows a local user to obtain elevated privileges.
The vulnerability exists due to unspecified flaw in lsmcode. A local user can obtain root privileges on the system.
Successful exploitation of this vulnerability will allow the local attacker to obtain elevated privileges on vulnerable system.

IBM VIOS
IBM AIX

Update fixed versions:
http://aix.software.ibm.com/aix/efixes/security/lsmcode_fix2.tar

• Exploit #2074 - CVEs (Proof-of-Concept exploits for CVEs found by the team at Rhino Security Labs) (March 18, 2020)
• Exploit #437 - IBM AIX 6.1/7.1/7.2.0.2 - 'lsmcode' Privilege Escalation (March 18, 2020)

• http://aix.software.ibm.com/aix/efixes/security/lsmcode_advisory2.asc

• Privilege escalation in IBM AIX