CVE-2024-41743
Published: 19 January 2025
Summary
CVE-2024-41743 is a high-severity Allocation of Resources Without Limits or Throttling (CWE-770) vulnerability in Ibm Txseries For Multiplatforms. Its CVSS base score is 7.5 (High).
Operationally, ranked at the 21.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-10 (Concurrent Session Control) and SC-5 (Denial-of-service Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SC-6 directly enforces limits on resource allocation by process, user, or connection type, mitigating the improper resource allocation exploited via persistent connections in CVE-2024-41743.
SC-5 implements protections against denial-of-service events like resource exhaustion from persistent connections, comprehensively addressing the availability impact of CVE-2024-41743.
AC-10 limits concurrent sessions or connections, preventing attackers from exhausting resources through persistent connections as in CVE-2024-41743.
NVD Description
IBM TXSeries for Multiplatforms 10.1 could allow a remote attacker to cause a denial of service using persistent connections due to improper allocation of resources.
Deeper analysisAI
IBM TXSeries for Multiplatforms 10.1 is affected by CVE-2024-41743, a vulnerability that could allow a remote attacker to cause a denial of service through the use of persistent connections. This issue stems from improper allocation of resources, mapped to CWE-770 (Allocation of Resources Without Limits or Throttling). The vulnerability received a CVSS v3.1 base score of 7.5, reflecting its high severity primarily due to the availability impact.
A remote attacker with no privileges required can exploit this vulnerability over the network with low complexity and no user interaction. By leveraging persistent connections, the attacker can trigger excessive resource consumption, leading to a denial of service condition that disrupts service availability without impacting confidentiality or integrity.
The IBM security advisory provides details on mitigation and available patches; refer to https://www.ibm.com/support/pages/node/7172103 for specific remediation steps.
Details
- CWE(s)