SB2023030226 - Multiple vulnerabilities in Dell PowerStore Family
Published: March 2, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 secuirty vulnerabilities.
1) Processor optimization removal or modification of security-critical code (CVE-ID: CVE-2022-29901)
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to the way non-transparent sharing of branch predictor targets between contexts. A local user can exploit the vulnerability to gain access to sensitive information.
2) Processor optimization removal or modification of security-critical code (CVE-ID: CVE-2022-28693)
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to unprotected alternative channel of return branch target prediction. A local user can gain access to sensitive information.
3) NULL pointer dereference (CVE-ID: CVE-2022-31681)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error. A local user with privileges within the VMX process only can perform a denial of service (DoS) attack against the host.
4) Buffer overflow (CVE-ID: CVE-2022-31696)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error in the way network socket are handled. A local privileged user can trigger memory corruption and execute arbitrary code with elevated privileges.
5) Out-of-bounds write (CVE-ID: CVE-2022-31705)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error within the USB 2.0 controller (EHCI). A local privileged user on the guest OS can trigger an out-of-bounds write and execute arbitrary code as the virtual machine's VMX process running on the host.
Remediation
Install update from vendor's website.