CVE-2024-41742
Published: 19 January 2025
Summary
CVE-2024-41742 is a high-severity Allocation of Resources Without Limits or Throttling (CWE-770) vulnerability in Ibm Txseries For Multiplatforms. Its CVSS base score is 7.5 (High).
Operationally, ranked at the 21.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SC-6 (Resource Availability).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates slowloris-type DoS attacks by implementing denial-of-service protections, including enforcement of timeouts on read operations to prevent resource exhaustion.
Remediates the specific flaw in improper timeout enforcement on individual read operations through timely application of vendor patches from the IBM advisory.
Protects system resource availability by allocating resources with throttling and safeguards against unthrottled read operations that lead to denial of service.
NVD Description
IBM TXSeries for Multiplatforms 10.1 is vulnerable to a denial of service, caused by improper enforcement of the timeout on individual read operations. By conducting a slowloris-type attacks, a remote attacker could exploit this vulnerability to cause a denial of…
more
service.
Deeper analysisAI
CVE-2024-41742 is a denial-of-service vulnerability in IBM TXSeries for Multiplatforms 10.1, stemming from improper enforcement of timeouts on individual read operations. This flaw, mapped to CWE-770 (Allocation of Resources Without Limits or Throttling), allows slowloris-type attacks to overwhelm the affected component.
A remote attacker requires no privileges or user interaction and can exploit this over the network with low attack complexity. Successful exploitation results in high availability impact, causing a denial of service, as reflected in the CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
IBM has published a security advisory with details on the vulnerability at https://www.ibm.com/support/pages/node/7172103.
Details
- CWE(s)