Privilege Escalation in IBM Licensing Operator via Misconfigured Permissions

Executive Summary

CVE-2025-12985 is a high-severity privilege escalation vulnerability in the IBM Licensing Operator. It occurs because the operator incorrectly assigns permissions to security-critical files, such as /etc/passwd, giving them read-write group privileges. This misconfiguration allows a local attacker inside a container running the IBM Licensing Operator image to escalate their privileges to root. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow a local attacker within a container running the IBM Licensing Operator image to gain root privileges. This means the attacker could fully control the container environment, potentially leading to unauthorized access, data manipulation, or disruption of services. [1]

Useful 0 Not Useful 0

Detection Guidance

You can detect this vulnerability by checking the permissions of security-critical files such as /etc/passwd inside the container running the IBM Licensing Operator image. Specifically, look for incorrect group read-write permissions on /etc/passwd. For example, run the command: ls -l /etc/passwd and verify if the group permissions include write access (e.g., -rw-rw-r--). If such permissions are present, the system is vulnerable. [1]

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability immediately, upgrade the IBM License Service to version 4.2.18 or later, where the issue has been fixed. Additionally, review and correct the permissions of critical files like /etc/passwd inside the container to remove inappropriate group write permissions. [1]

Useful 0 Not Useful 0