CVE-2024-27273

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

IBM AIX's Unix domain (AIX 7.2, 7.3, VIOS 3.1, and VIOS 4.1) datagram socket implementation could potentially expose applications using Unix domain datagram sockets with SO_PEERID operation and may lead to privilege escalation. IBM X-Force ID: 284903.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-266

Affected software

Vendor	Product	Versions
IBM	AIX	7.2, 7.3, VIOS 3.1, VIOS 4.1
ibm	aix	7.3
ibm	aix	3.1; 4.1; 7.2; 7.3

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/284903Vendor Advisory
https://www.ibm.com/support/pages/node/7150297Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/284903Vendor Advisory
https://www.ibm.com/support/pages/node/7150297Vendor Advisory

Timeline

Published: May 7, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-272757.8IBM i 7.2, 7.3, 7.4, and 7.5 contains a local privilege escalation vulnerability caused by an insufficient authority requirement. A local us CVE-2024-272775.5The private key for the IBM Storage Protect Plus Server 10.1.0 through 10.1.16 certificate can be disclosed, undermining the security of the CVE-2024-272785.4OpenPNE Plugin "opTimelinePlugin" 1.2.11 and earlier contains a cross-site scripting vulnerability. On the site which uses the affected prod CVE-2024-272796.5Directory traversal vulnerability exists in a-blog cms Ver.3.1.x series Ver.3.1.9 and earlier, Ver.3.0.x series Ver.3.0.30 and earlier, Ver.CVE-2024-27285.5Information exposure vulnerability in the CIGESv2 system. This vulnerability could allow a local attacker to intercept traffic due to the la CVE-2024-272809.8A buffer-overread issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The ungetbyte CVE-2024-272814.5An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0. When parsing .rdoc_options (used for configur CVE-2024-272826.6An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the Ruby regex compiler, it is possible to extra CVE-2024-272837.2A vulnerability was discovered in Veritas eDiscovery Platform before 10.2.5. The application administrator can upload potentially malicious CVE-2024-272847.5cassandra-rs is a Cassandra (CQL) driver for Rust. Code that attempts to use an item (e.g., a row) returned by an iterator after the iterato CVE-2024-272856.1YARD is a Ruby Documentation tool. The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scriptin CVE-2024-272866.5Zulip is an open-source team collaboration tool. When a user moves a Zulip message, they have the option to move all messages in the topic,