Multiple vulnerabilities in Dell Cloud Tiering Appliance

1) Use-after-free

EUVDB-ID: #VU87193

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26622

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the tomoyo_write_control() function. A local  user can trigger a use-after-free error and execute arbitrary code with elevated privileges.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Memory leak

EUVDB-ID: #VU87206

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-40633

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak within the gif2rgb() function in util/gif2rgb.c. A remote attacker can force the application to leak memory and perform denial of service attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) OS Command Injection

EUVDB-ID: #VU84789

Risk: Medium

CVSSv3.1: 6.7 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2023-51385

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Exploit availability: Yes

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation when processing user names, if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. A remote attacker can execute arbitrary OS commands via an untrusted Git repository.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

4) Covert timing channel

EUVDB-ID: #VU85267

Risk: Medium

CVSSv3.1: 5.1 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-5388

CWE-ID: CWE-385 - Covert Timing Channel

Exploit availability: No

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to insufficient fix for #VU84108 (CVE-2023-4421). A remote attacker can perform Marvin attack and gain access to sensitive information.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Improper Privilege Management

EUVDB-ID: #VU86275

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-0985

CWE-ID: CWE-269 - Improper Privilege Management

Exploit availability: No

The vulnerability allows a remote user to escalate privileges within the database.

The vulnerability exists due to late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY. A remote user who is an object creator can execute arbitrary SQL functions as the command issuer.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Unchecked Return Value

EUVDB-ID: #VU84540

Risk: Low

CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-6918

CWE-ID: CWE-252 - Unchecked Return Value

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to libssh does not check for returned values of message digest (MD) operations in low memory conditions. A remote attacker can terminate the connection or force the library to use weak keys.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) OS Command Injection

EUVDB-ID: #VU84538

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-6004

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation in OpenSSH client. If an invalid user or hostname that contained shell metacharacters was passed to ssh(1), and a ProxyCommand, LocalCommand directive or "match exec" predicate referenced the user or hostname via %u, %h or similar expansion token, then an attacker who could supply arbitrary user/hostnames to ssh(1) could potentially perform command injection depending on what quoting was present in the user-supplied ssh_config(5) directive.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Inadequate encryption strength

EUVDB-ID: #VU84537

Risk: Low

CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-48795

CWE-ID: CWE-326 - Inadequate Encryption Strength

Exploit availability: No

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to incorrect implementation of the SSH Binary Packet Protocol (BPP), which mishandles the handshake phase and the use of sequence numbers. A remote attacker can perform MitM attack and delete the SSH2_MSG_EXT_INFO message sent before authentication starts, allowing the attacker to disable a subset of the keystroke timing obfuscation features introduced in OpenSSH 9.5.

The vulnerability was dubbed "Terrapin attack" and it affects both client and server implementations.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Improper Authentication

EUVDB-ID: #VU75740

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-2283

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error within the pki_verify_data_signature() function in pki_crypto.c. The pki_key_check_hash_compatible() function can return SSH_OK value if memory allocation error happens later in the function. The  A remote attacker can bypass authentication process and gain unauthorized access to the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Input validation error

EUVDB-ID: #VU75741

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-1667

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to multiple errors in kex implementation, related to kex guessing algorithm. A remote attacker can bypass implemented security restrictions.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Buffer overflow

EUVDB-ID: #VU56217

Risk: High

CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-3634

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when handling shared secrets. A remote attacker can supply a shared secret of a different size, trigger a memory corruption during the second key re-exchange and crash the application or potentially execute arbitrary code.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Resource management error

EUVDB-ID: #VU26756

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-1730

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper resource management while cleaning the AES-CTR ciphers when closing the connection. A remote attacker can initiate a connection to the client and server that supports AES-CTR ciphers and close the connection before ciphers are initialized, triggering a denial of service condition (service crash). The vulnerability affects both client and server implementations.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) NULL pointer dereference

EUVDB-ID: #VU34008

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-16135

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in tftpserver.c if ssh_buffer_new returns NULL. A remote attacker can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) OS Command Injection

EUVDB-ID: #VU23508

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-14889

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to incorrect handling of the SCP command parameters when initiating the connection within the ssh_scp_new() function. A remote attacker can trick victim into using a specially crafted SCP command to connect to a remote SCP server and execute arbitrary commands on the target server with privileges of the current user.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) NULL pointer dereference

EUVDB-ID: #VU90640

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26607

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the sii902x_init() and sii902x_probe() functions in drivers/gpu/drm/bridge/sii902x.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Out-of-bounds read

EUVDB-ID: #VU87208

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-48161

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the DumpSCreen2RGB() function in gif2rgb.c. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Resource exhaustion

EUVDB-ID: #VU87499

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26602

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper resource management in kernel/sched/membarrier.c. A local user can trigger resource exhaustion and perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) NULL pointer dereference

EUVDB-ID: #VU87369

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26595

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the spectrum_acl_tcam() function in drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c. A local user can pass specially crafted data to the driver and perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Out-of-bounds read

EUVDB-ID: #VU89250

Risk: Low

CVSSv3.1: 3.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26593

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the i801_block_transaction_by_block() function in drivers/i2c/busses/i2c-i801.c. A local user can trigger an out-of-bounds read error and read contents of memory on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Buffer overflow

EUVDB-ID: #VU88886

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26589

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error within the adjust_ptr_min_max_vals() function in kernel/bpf/verifier.c. A local user can crash the OS kernel.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Out-of-bounds write

EUVDB-ID: #VU88935

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26586

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error within the mlxsw_sp_acl_tcam_init() function in drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c. A local user can trigger stack corruption and crash the kernel.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Race condition

EUVDB-ID: #VU89251

Risk: Medium

CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26585

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a race condition within the tls_encrypt_done() function in net/tls/tls_sw.c. A remote attacker user can send specially crafted requests to the system and perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Out-of-bounds read

EUVDB-ID: #VU87595

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-23851

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition within the copy_params() function in drivers/md/dm-ioctl.c. A remote attacker can trigger an out-of-bounds read and perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) Off-by-one

EUVDB-ID: #VU86019

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-23849

CWE-ID: CWE-193 - Off-by-one Error

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an off-by-one error within the rds_recv_track_latency() function in net/rds/af_rds.c. A local user can trigger an off-by-one error and perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) Stack-based buffer overflow

EUVDB-ID: #VU87165

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-1151

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in the Open vSwitch sub-component in the Linux Kernel. A remote unauthenticated attacker can send specially crafted packets to the system. trigger a stack-based buffer overflow and perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

26) Resource management error

EUVDB-ID: #VU86553

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-0607

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the nft_byteorder_eval() function in the Netfilter subsystem. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) Improper Initialization

EUVDB-ID: #VU86579

Risk: Low

CVSSv3.1: 3.3 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-0340

CWE-ID: CWE-665 - Improper Initialization

Exploit availability: No

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to improper initialization within the vhost_new_msg() function in drivers/vhost/vhost.c in the Linux kernel vhost driver. A local user can run a specially crafted application to gain access to sensitive kernel information.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

28) Security features bypass

EUVDB-ID: #VU92172

Risk: Low

CVSSv3.1: 4.1 [CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52597

CWE-ID: CWE-254 - Security Features

Exploit availability: No

The vulnerability allows a local privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A local privileged can trigger resource exhaustion and perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

29) NULL pointer dereference

EUVDB-ID: #VU89390

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52574

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in drivers/net/team/team.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

30) Heap-based buffer overflow

EUVDB-ID: #VU87207

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-28506

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the DumpScreen2RGB() function in gif2rgb.c. A remote attacker can pass specially crafted file to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

31) Path traversal

EUVDB-ID: #VU85896

Risk: High

CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-7207

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

The vulnerability allows a remote attacker to overwrite arbitrary files on the system.

The vulnerability exists due to input validation error when processing filenames inside cpio archives. A remote attacker can trick the victim to open a specially crafted cpio archive and overwrite arbitrary files on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

32) Improper error handling

EUVDB-ID: #VU90959

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52532

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the mana_poll_tx_cq() function in drivers/net/ethernet/microsoft/mana/mana_en.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

33) Improper input validation

EUVDB-ID: #VU10837

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-7208

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in the coff_pointerize_aux function in the coffgen.c source code due to insufficient validation of an index. A remote attacker can create a specially crafted COFF file, trick the victim into opening it, trigger a segmentation fault and cause the service to crash.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

34) Race condition

EUVDB-ID: #VU88857

Risk: Medium

CVSSv3.1: 5.5 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-3758

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to a race condition where the GPO policy is not consistently applied for authenticated users. A remote user can exploit the race and gain unauthorized access to the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

35) Improper input validation

EUVDB-ID: #VU88668

Risk: Low

CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-21094

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Hotspot component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

36) Improper input validation

EUVDB-ID: #VU88665

Risk: Low

CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-21085

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the Concurrency component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

37) Improper input validation

EUVDB-ID: #VU88667

Risk: Low

CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-21068

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Hotspot component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

38) Improper input validation

EUVDB-ID: #VU88669

Risk: Low

CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-21012

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Networking component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

39) Improper input validation

EUVDB-ID: #VU88666

Risk: Low

CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-21011

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the Hotspot component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

40) OS Command Injection

EUVDB-ID: #VU88533

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-32487

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation when handling newline characters in the filename in filename.c. A remote attacker can trick the victim to pass a specially crafted filename to the affected command and execute arbitrary OS commands on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

41) OS Command Injection

EUVDB-ID: #VU86885

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48624

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation within the close_altfile() function in filename.c. A remote attacker can trick the victim into using a specially crafted argument for the less command and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

42) Input validation error

EUVDB-ID: #VU88144

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-28182

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to reading the unbounded number of HTTP/2 CONTINUATION frames. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

43) Input validation error

EUVDB-ID: #VU87906

Risk: Low

CVSSv3.1: 6.6 [CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2024-28085

CWE-ID: CWE-20 - Improper input validation

Exploit availability: Yes

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to insufficient validation of user-supplied arguments along with setgid tty permissions within the wall command. A local user can execute arbitrary commands with escalated privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

44) Memory leak

EUVDB-ID: #VU88226

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26461

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak in /krb5/src/lib/gssapi/krb5/k5sealv3.c. A remote attacker can force the application to leak memory and perform denial of service attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

45) Memory leak

EUVDB-ID: #VU88225

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26458

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak in /krb5/src/lib/rpc/pmap_rmt.c. A remote attacker can perform a denial of service attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

46) Resource exhaustion

EUVDB-ID: #VU86948

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48064

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources within the bfd_dwarf2_find_nearest_line_with_alt() function in dwarf2.c. A remote attacker can trigger resource exhaustion via a crafted ELF file and perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

47) Out-of-bounds read

EUVDB-ID: #VU37961

Risk: Medium

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-16829

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a remote attacker to gain access to perform denial of service (DoS) attack.

The vulnerability exists due to a boundary condition within the elf-properties.c function in the Binary File Descriptor (BFD) library (aka libbfd), as distributed file. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger out-of-bounds read error and crash the affected application.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

48) NULL pointer dereference

EUVDB-ID: #VU85808

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-0727

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error when processing fields in the PKCS12 certificate. A remote attacker can pass specially crafted certificate to the server and perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

49) Improper Authentication

EUVDB-ID: #VU85764

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-42465

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

The vulnerability allows a local user to bypass authentication process.

The vulnerability exists due to insufficient resistance to rowhammer attacks. A local user can bypass authentication process and gain unauthorized access to the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

50) Stack-based buffer overflow

EUVDB-ID: #VU87189

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-22667

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the did_set_langmap() function in map.c. A remote attacker can trick the victim to open a specially crafted file, trigger a stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

51) Use-after-free

EUVDB-ID: #VU83442

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-48706

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error within the ex_substitute() function in src/charset.c when executing the ":s" command. A remote attacker can trick the victim to open a specially crafted file, trigger a use-after-free error and crash the application.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

52) Integer overflow

EUVDB-ID: #VU83386

Risk: Low

CVSSv3.1: 2.7 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-48237

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to integer overflow when shifting lines in operator pending mode. A remote attacker can trick the victim to open a specially crafted file, trigger an integer overflow and crash the application.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

53) Integer overflow

EUVDB-ID: #VU83387

Risk: Low

CVSSv3.1: 2.7 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-48236

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to integer overflow when using the z= command. A remote attacker can trick the victim to open a specially crafted file, trigger an integer overflow and crash the application.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

54) Integer overflow

EUVDB-ID: #VU83388

Risk: Low

CVSSv3.1: 2.7 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-48235

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

55) Integer overflow

EUVDB-ID: #VU83389

Risk: Low

CVSSv3.1: 2.7 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-48234

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

56) Integer overflow

EUVDB-ID: #VU83390

Risk: Low

CVSSv3.1: 2.7 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-48233

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

57) Integer overflow

EUVDB-ID: #VU83391

Risk: Low

CVSSv3.1: 3.7 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-48232

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

58) Use-after-free

EUVDB-ID: #VU83392

Risk: Low

CVSSv3.1: 2.7 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-48231

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error when closing the window. A remote attacker can trick the victim to open a specially crafted file and crash the application.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

59) Use-after-free

EUVDB-ID: #VU80505

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-4750

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to crash the application.

The vulnerability exists due to a use-after-free error within the is_qf_win() function in quickfix.c. A remote attacker can trick the victim to open a specially crafted file and crash the application.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

60) Information Exposure Through Timing Discrepancy

EUVDB-ID: #VU85623

Risk: Medium

CVSSv3.1: 4.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-0553

CWE-ID: CWE-208 - Information Exposure Through Timing Discrepancy

Exploit availability: No

The vulnerability allows a remote attacker to perform timing attack.

The vulnerability exists due to the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding. A remote attacker can perform timing sidechannel attack in RSA-PSK key exchange.

Note, the vulnerability exists due to incomplete fox for #VU83316 (CVE-2023-5981).

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

61) Information Exposure Through Timing Discrepancy

EUVDB-ID: #VU83316

Risk: Medium

CVSSv3.1: 4.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-5981

CWE-ID: CWE-208 - Information Exposure Through Timing Discrepancy

Exploit availability: No

The vulnerability allows a remote attacker to perform timing attack.

The vulnerability exists due to the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding. A remote attacker can perform timing sidechannel attack in RSA-PSK key exchange.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

62) UNIX symbolic link following

EUVDB-ID: #VU87185

Risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-6597

CWE-ID: CWE-61 - UNIX Symbolic Link (Symlink) Following

Exploit availability: No

The vulnerability allows a local user to delete arbitrary files on the system.

The vulnerability exists due to a symlink following issue during cleanup when handling temporary files. A local user can create a specially crafted symbolic link to a critical file on the system and delete it.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

63) Improper error handling

EUVDB-ID: #VU90958

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52569

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the btrfs_balance_delayed_items() and btrfs_insert_delayed_dir_index() functions in fs/btrfs/delayed-inode.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

64) Buffer overflow

EUVDB-ID: #VU91210

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52531

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the drivers/net/wireless/intel/iwlwifi/mvm/fw.c. A local user can escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

65) Use-after-free

EUVDB-ID: #VU86576

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-0775

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the __ext4_remount() function in fs/ext4/super.c in ext4. A local user can trigger a use-after-free error and execute arbitrary code on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

66) Improper Resource Shutdown or Release

EUVDB-ID: #VU92189

Risk: Low

CVSSv3.1: 5.8 [CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-46953

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

Exploit availability: No

The vulnerability allows a local privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A local privileged user can trigger resource exhaustion and perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

67) Improper Check for Unusual or Exceptional Conditions

EUVDB-ID: #VU89264

Risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-46934

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

Exploit availability: No

The vulnerability allows a local user to produce warnings from the userspace.

The vulnerability exists due to improper error handling within the compat_i2cdev_ioctl() function in drivers/i2c/i2c-dev.c. A local user can pass specially crafted data to the driver and influence its behavior.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

68) Improper Initialization

EUVDB-ID: #VU92173

Risk: Low

CVSSv3.1: 2.2 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-46932

CWE-ID: CWE-665 - Improper Initialization

Exploit availability: No

The vulnerability allows a local user to perform a denial of service attack.

The vulnerability exists due to improper initialization. A local user can run a specially crafted application to perform a denial of service attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

69) Use-after-free

EUVDB-ID: #VU90257

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-46929

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the sctp_transport_lookup_process() and sctp_transport_get_idx() functions in net/sctp/socket.c, within the sctp_sock_dump() and sctp_sock_filter() functions in net/sctp/sctp_diag.c, within the sctp_endpoint_free() and sctp_endpoint_destroy() functions in net/sctp/endpointola.c. A local user can escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

70) Memory leak

EUVDB-ID: #VU88212

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-46924

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak in drivers/nfc/st21nfca/i2c.c. A local user can perform a denial of service attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

71) Incorrect calculation

EUVDB-ID: #VU88215

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-46915

CWE-ID: CWE-682 - Incorrect Calculation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect calculation within the nft_limit_init() function in net/netfilter/nft_limit.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

72) Memory leak

EUVDB-ID: #VU87992

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-46906

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform DoS attack on the target system.

The vulnerability exists due memory leak within the hid_submit_ctrl() function in drivers/hid/usbhid/hid-core.c. A local user can force the driver to leak memory and perform denial of service attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

73) NULL pointer dereference

EUVDB-ID: #VU87991

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-46905

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error on disconnect regression within the hso_serial_tty_unregister() functin in drivers/net/usb/hso.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

74) NULL pointer dereference

EUVDB-ID: #VU87990

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-46904

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error during tty device unregistration
 within the get_free_serial_index() function in drivers/net/usb/hso.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

75) Memory leak

EUVDB-ID: #VU88216

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-36784

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due a reference leak in drivers/i2c/busses/i2c-cadence.c. A local user can perform a denial of service attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

76) Memory leak

EUVDB-ID: #VU87987

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-36777

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the dvb_media_device_free() function in drivers/media/dvb-core/dvbdev.c. A local user can crash the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

77) Use-after-free

EUVDB-ID: #VU87986

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-25162

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error within the i2c_put_adapter() function in drivers/i2c/i2c-core-base.c. A local user can trigger a use-after-free error and crash the kernel.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

78) Use-after-free

EUVDB-ID: #VU86577

Risk: High

CVSSv3.1: 8.4 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C]

CVE-ID: CVE-2024-1086

CWE-ID: CWE-416 - Use After Free

Exploit availability: Yes

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the netfilter nf_tables component in Linux kernel. A local user can trigger a use-after-free error and execute arbitrary code on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

79) Integer underflow

EUVDB-ID: #VU86552

Risk: High

CVSSv3.1: 7 [CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-0565

CWE-ID: CWE-191 - Integer underflow

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer underflow within the receive_encrypted_standard() function in fs/smb/client/smb2ops.c in the SMB Client sub-component in the Linux Kernel. A remote attacker can trick the victim to connect to a malicious SMB server, trigger an integer underflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

80) Use-after-free

EUVDB-ID: #VU88893

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-46966

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the cm_write() function in drivers/acpi/custom_method.c. A local user can trigger a use-after-free error and escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

81) NULL pointer dereference

EUVDB-ID: #VU85423

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-6915

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the ida_free() function in lib/idr.c. A local user can pass specially crafted data to the system and perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

82) NULL pointer dereference

EUVDB-ID: #VU85852

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-6536

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the __nvmet_req_complete() function in the Linux kernel's NVMe driver. A remote attacker can send specially crafted NVMe-oF/TCP packets to the system and perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

83) NULL pointer dereference

EUVDB-ID: #VU85853

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-6535

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the nvmet_tcp_execute_request() function in the Linux kernel's NVMe driver. A remote attacker can send specially crafted NVMe-oF/TCP packets to the system and perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

84) NULL pointer dereference

EUVDB-ID: #VU85854

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-6356

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the nvmet_tcp_build_iovec() function in the Linux kernel's NVMe driver. A remote attacker can pass specially crafted TCP packets to the system and perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

85) Out-of-bounds write

EUVDB-ID: #VU85840

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-6040

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the nf_tables_newtable() function in netfilter nf_tables. A local user can trigger an out-of-bounds write and execute arbitrary code with elevated privileges.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

86) Race condition

EUVDB-ID: #VU85029

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-51782

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition in the Amateur Radio X.25 PLP (Rose) support. A local user can exploit the race and escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

87) Race condition

EUVDB-ID: #VU85024

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-51780

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition in the ATM (Asynchronous Transfer Mode) subsystem in Linux kernel. A local user can exploit the race and escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

88) Use-after-free

EUVDB-ID: #VU86268

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-51043

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in drivers/gpu/drm/drm_atomic.c. A local user can trigger a use-after-free error and execute arbitrary code with elevated privileges.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

89) Use-after-free

EUVDB-ID: #VU81693

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-4921

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in the qfq_dequeue() function within the the Linux kernel's net/sched: sch_qfq component. A local user can trigger a use-after-free error and execute arbitrary code with elevated privileges.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

90) Use-after-free

EUVDB-ID: #VU82755

Risk: Low

CVSSv3.1: 5.9 [CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-47233

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows an attacker to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the brcm80211 in a brcmf_cfg80211_detach in the device unplugging (disconnect the USB by hotplug) code. An attacker with physical access to device can trigger a use-after-free error and escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

91) Input validation error

EUVDB-ID: #VU85682

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-46838

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows an unprivileged guest to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of network packets at the backend. An unprivileged guest can send zero-length packets to the OS kernel and perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

92) Integer overflow

EUVDB-ID: #VU86575

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-33631

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to integer overflow when mounting a malicious filesystem. A local user can mount a specially crafted filesystem, trigger an integer overflow and execute arbitrary code.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

93) NULL pointer dereference

EUVDB-ID: #VU90651

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-46964

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the qla24xx_enable_msix() function in drivers/scsi/qla2xxx/qla_isr.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

94) Out-of-bounds write

EUVDB-ID: #VU92191

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-46974

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

The vulnerability allows a local user to perform a denial of service attack.

The vulnerability exists due to improper handling of masking negation logic upon a negative destination register. A local user can cause a denial of service by exploiting this flaw.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

95) Use-after-free

EUVDB-ID: #VU90237

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52530

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ieee80211_key_link() function in net/mac80211/key.c, within the ieee80211_add_key() function in net/mac80211/cfg.c. A local user can escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

96) Use-after-free

EUVDB-ID: #VU86560

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-51042

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the amdgpu_cs_wait_all_fences() function in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c. A local user can trigger a use-after-free error and execute arbitrary code with elevated privileges.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

97) Race condition

EUVDB-ID: #VU88106

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52502

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition within the nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() functions in net/nfc/llcp_core.c. A local user can exploit the race and execute arbitrary code with elevated privileges.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

98) Stack-based buffer overflow

EUVDB-ID: #VU91302

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52482

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to stack overflow within the VULNBL_AMD() function in arch/x86/kernel/cpu/common.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

99) Use-after-free

EUVDB-ID: #VU91066

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52478

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the hidpp_probe() function in drivers/hid/hid-logitech-hidpp.c. A local user can escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

100) Use-after-free

EUVDB-ID: #VU90247

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52475

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the powermate_disconnect() function in drivers/input/misc/powermate.c. A local user can escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

101) NULL pointer dereference

EUVDB-ID: #VU90660

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52463

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the efivarfs_get_tree() function in fs/efivarfs/super.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

102) Out-of-bounds read

EUVDB-ID: #VU88891

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52451

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition within the dlpar_memory_remove_by_index() function in arch/powerpc/platforms/pseries/hotplug-memory.c. A local user can trigger an out-of-bounds read and perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

103) NULL pointer dereference

EUVDB-ID: #VU87742

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52449

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in mtd. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

104) NULL pointer dereference

EUVDB-ID: #VU87741

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52448

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in gfs2_rgrp_dump() function. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

105) Use-after-free

EUVDB-ID: #VU87745

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52445

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in pvrusb2. A local user can execute arbitrary code with elevated privileges.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

106) NULL pointer dereference

EUVDB-ID: #VU89245

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52443

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the unpack_profile() function in security/apparmor/policy_unpack.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

107) Use-after-free

EUVDB-ID: #VU87573

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52439

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the uio_open() function in drivers/uio/uio.c. A local user can trigger a use-after-free error and execute arbitrary code with elevated privileges.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

108) Improper Check for Unusual or Exceptional Conditions

EUVDB-ID: #VU87166

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52429

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the dm_table_create() function in drivers/md/dm-table.c. A local user can pass specially crafted data to the kernel and perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

109) Resource exhaustion

EUVDB-ID: #VU88378

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52340

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an error when processing very large ICMPv6 packets. A remote attacker can send a flood of IPv6 ICMP6 PTB messages, cause the high lock contention and increased CPU usage, leading to a denial of service.

Successful vulnerability exploitation requires a attacker to be on the local network or have a high bandwidth connection.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

110) NULL pointer dereference

EUVDB-ID: #VU86243

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-46343

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the send_acknowledge() function in net/nfc/nci/spi.c. A local user can pass specially crafted data to the system and perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

111) Deadlock

EUVDB-ID: #VU89261

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-46989

CWE-ID: CWE-833 - Deadlock

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to deadlock within the inhfsplus_file_truncate() function in fs/hfsplus/extents.c. A local user can crash the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

112) Use-after-free

EUVDB-ID: #VU82758

Risk: Low

CVSSv3.1: 6.1 [AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-35827

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local authenticated user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ravb_remove in drivers/net/ethernet/renesas/ravb_main.c. A local authenticated user can trigger a use-after-free error and escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

113) Information disclosure

EUVDB-ID: #VU87457

Risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-28746

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to information exposure through microarchitectural state after transient execution from some register files for some Intel Atom Processors. A local user can gain access to sensitive information.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

114) Resource exhaustion

EUVDB-ID: #VU92194

Risk: Low

CVSSv3.1: 3.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48627

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A local user can trigger resource exhaustion and perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

115) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU64207

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-20154

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to unspecified error in the Linux Kernel. A local user can bypass security restrictions and escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

116) Out-of-bounds read

EUVDB-ID: #VU90346

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47083

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the mtk_xt_get_gpio_n() function in drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

117) Use-after-free

EUVDB-ID: #VU90242

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47078

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the rxe_qp_init_req(), rxe_qp_init_resp() and rxe_qp_from_init() functions in drivers/infiniband/sw/rxe/rxe_qp.c. A local user can escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

118) Resource exhaustion

EUVDB-ID: #VU92193

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47076

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A local user can trigger resource exhaustion and perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

119) Resource exhaustion

EUVDB-ID: #VU92484

Risk: Low

CVSSv3.1: 4.1 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47069

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an error within the IPC implementation in Linux kernel. A local user can trigger resource exhaustion and perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

120) Use-after-free

EUVDB-ID: #VU90244

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47061

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the kvm_io_bus_unregister_dev() function in virt/kvm/kvm_main.c. A local user can escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

121) NULL pointer dereference

EUVDB-ID: #VU92997

Risk: Low

CVSSv3.1: 5.8 [CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47060

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local privileged user to execute arbitrary code on the target system.

The vulnerability exists due to a NULL pointer dereference error. A local privileged user can pass specially crafted data to the application and execute arbitrary code on the target system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

122) Memory leak

EUVDB-ID: #VU91658

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47054

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the qcom_ebi2_probe() function in drivers/bus/qcom-ebi2.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

123) Use-after-free

EUVDB-ID: #VU91068

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47013

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the emac_mac_tx_buf_send() function in drivers/net/ethernet/qualcomm/emac/emac-mac.c. A local user can escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

124) Use-after-free

EUVDB-ID: #VU90253

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47012

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the siw_mr_add_mem() function in drivers/infiniband/sw/siw/siw_mem.c. A local user can escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

125) NULL pointer dereference

EUVDB-ID: #VU90646

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47005

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the pci_epf_test_bind() function in drivers/pci/endpoint/functions/pci-epf-test.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.29

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:

http://www.dell.com/support/kbdoc/nl-nl/000225431/dsa-2024-238-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.