Multiple vulnerabilities in Dell Cloud Tiering Appliance

1) Improper locking

EUVDB-ID: #VU90753

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35914

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the lock_rename() and unlock_rename() functions in fs/nfsd/vfs.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU89899

Risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52880

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a local user to bypass implemented security restrictions.

The vulnerability exists due to missing permissions checks within the gsmld_open() function in drivers/tty/n_gsm.c. A local user with CAP_NET_ADMIN capability can create a GSM network.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Race condition

EUVDB-ID: #VU85022

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-6531

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition when the unix garbage collector's deletion of a SKB races with unix_stream_read_generic() on the socket that the SKB is queued on. A local user can exploit the race and escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Input validation error

EUVDB-ID: #VU88887

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26581

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in net/netfilter/nft_set_rbtree.c. A locla user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Race condition

EUVDB-ID: #VU88135

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26643

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition within the nf_tables_unbind_set() function in net/netfilter/nf_tables_api.c. A local user can exploit the race and escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Integer underflow

EUVDB-ID: #VU91674

Risk: Low

CVSSv3.1: 6.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26828

CWE-ID: CWE-191 - Integer underflow

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer underflow within the parse_server_interfaces() function in fs/smb/client/smb2ops.c. A local user can execute arbitrary code.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Improper locking

EUVDB-ID: #VU92034

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26925

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the __nf_tables_abort() and nf_tables_abort() functions in net/netfilter/nf_tables_api.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Double free

EUVDB-ID: #VU90894

Risk: Low

CVSSv3.1: 6.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26929

CWE-ID: CWE-415 - Double Free

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a double free error within the qla2x00_els_dcmd_sp_free() and qla24xx_els_dcmd_iocb() functions in drivers/scsi/qla2xxx/qla_iocb.c. A local user can execute arbitrary code.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Double free

EUVDB-ID: #VU90895

Risk: Low

CVSSv3.1: 6.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26930

CWE-ID: CWE-415 - Double Free

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a double free error within the kfree() function in drivers/scsi/qla2xxx/qla_os.c. A local user can execute arbitrary code.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Use-after-free

EUVDB-ID: #VU89672

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-27398

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error within the sco_sock_timeout() function in net/bluetooth/sco.c. A remote attacker can trigger a use-after-free error and perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Buffer overflow

EUVDB-ID: #VU93470

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-27413

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the efi_capsule_open() function in drivers/firmware/efi/capsule-loader.c. A local user can escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Use-after-free

EUVDB-ID: #VU90164

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35811

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the brcmf_notify_escan_complete() and brcmf_cfg80211_detach() functions in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c. A local user can escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Improper locking

EUVDB-ID: #VU90752

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35895

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the __sock_map_delete() and sock_hash_delete_elem() functions in net/core/sock_map.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Man-in-the-Middle (MitM) attack

EUVDB-ID: #VU28001

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-10135

CWE-ID: CWE-300 - Channel Accessible by Non-Endpoint ('Man-in-the-Middle')

Exploit availability: No

The vulnerability allows a remote attacker to perform a Man-in-the-Middle (MitM) attack.

The vulnerability exists in the implementation of Bluetooth v5.0, v4.2, v4.1, v4.0 on devices manufactured by multiple vendors. A remote attacker with physical proximity to the victim can successful perform a MitM attack even against previously paired devices and gain access to sensitive information.

Below is the list of chips and devices, confirmed to be vulnerable:

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Use-after-free

EUVDB-ID: #VU91056

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52840

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the rmi_unregister_function() function in drivers/input/rmi4/rmi_bus.c. A local user can escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Improper Validation of Array Index

EUVDB-ID: #VU63385

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-43389

CWE-ID: CWE-129 - Improper Validation of Array Index

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code with elevated privileges.

The vulnerability exists due to improper validation of array index in the ISDN CAPI implementation within detach_capi_ctr() function in drivers/isdn/capi/kcapi.c. A local user can send specially crafted data to the system and execute arbitrary code with elevated privileges.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Out-of-bounds read

EUVDB-ID: #VU92900

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-4439

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the detach_capi_ctr() function in drivers/isdn/capi/kcapi.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Use-after-free

EUVDB-ID: #VU90090

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47247

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the mlx5e_take_all_route_decap_flows() and mlx5e_encap_valid() functions in drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c, within the wait_for_completion() and mlx5e_take_all_encap_flows() functions in drivers/net/ethernet/mellanox/mlx5/core/en/rep/tc.c, within the mlx5e_rep_neigh_update() and mlx5e_rep_update_flows() functions in drivers/net/ethernet/mellanox/mlx5/core/en/rep/neigh.c. A local user can escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Use-after-free

EUVDB-ID: #VU90103

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47311

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the emac_remove() function in drivers/net/ethernet/qualcomm/emac/emac.c. A local user can escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Use-after-free

EUVDB-ID: #VU91060

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47328

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the iscsi_prep_bidi_ahs(), iscsi_check_tmf_restrictions(), iscsi_data_in_rsp(), EXPORT_SYMBOL_GPL(), iscsi_exec_task_mgmt_fn(), iscsi_eh_abort(), iscsi_eh_device_reset(), iscsi_session_recovery_timedout(), iscsi_conn_failure(), iscsi_eh_target_reset(), iscsi_session_setup(), iscsi_conn_setup(), iscsi_conn_teardown(), iscsi_conn_start() and iscsi_start_session_recovery() functions in drivers/scsi/libiscsi.c. A local user can escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Resource management error

EUVDB-ID: #VU93188

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47368

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the enetc_clear_bdrs() and enetc_setup_irqs() functions in drivers/net/ethernet/freescale/enetc/enetc.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Use-after-free

EUVDB-ID: #VU90136

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47372

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the macb_remove() function in drivers/net/ethernet/cadence/macb_pci.c. A local user can escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Use-after-free

EUVDB-ID: #VU90139

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47379

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the spin_lock_irq() and blkcg_deactivate_policy() functions in block/blk-cgroup.c. A local user can escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) Use-after-free

EUVDB-ID: #VU91051

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47571

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the _rtl92e_pci_disconnect() function in drivers/staging/rtl8192e/rtl8192e/rtl_core.c. A local user can escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) Use of uninitialized resource

EUVDB-ID: #VU92933

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47583

CWE-ID: CWE-908 - Use of Uninitialized Resource

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the mxl111sf_init() and mxl111sf_get_stream_config_dvbt() functions in drivers/media/usb/dvb-usb-v2/mxl111sf.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

26) Stack-based buffer overflow

EUVDB-ID: #VU61216

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-0435

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the Linux kernel networking module for the Transparent Inter-Process Communication (TIPC) protocol. A remote unauthenticated attacker can send specially crafted traffic to the system, trigger a stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system but requires that the TIPC bearer is set up.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU61217

Risk: Low

CVSSv3.1: 7.5 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C]

CVE-ID: CVE-2022-22942

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: Yes

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to an error in the vmwgfx driver in Linux kernel. A local unprivileged user can gain access to files opened by other processes on the system through a dangling 'file' pointer.

Exploiting this vulnerability requires an attacker to have access to either /dev/dri/card0 or /dev/dri/rendererD128 and be able to issue an ioctl() on the resulting file descriptor.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

28) Buffer overflow

EUVDB-ID: #VU93143

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52871

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the qcom_llcc_probe() function in drivers/soc/qcom/llcc-qcom.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

29) NULL pointer dereference

EUVDB-ID: #VU90548

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52686

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the opal_event_init() function in arch/powerpc/platforms/powernv/opal-irqchip.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

30) Input validation error

EUVDB-ID: #VU92925

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48711

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the tipc_mon_rcv() function in net/tipc/monitor.c, within the tipc_link_proto_rcv() function in net/tipc/link.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

31) Use-after-free

EUVDB-ID: #VU90055

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47541

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the mlx4_en_try_alloc_resources() function in drivers/net/ethernet/mellanox/mlx4/en_netdev.c. A local user can escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

32) Buffer overflow

EUVDB-ID: #VU91305

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47485

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the qib_user_sdma_num_pages(), qib_user_sdma_free_pkt_frag(), qib_user_sdma_pin_pkt() and qib_user_sdma_queue_pkts() functions in drivers/infiniband/hw/qib/qib_user_sdma.c. A local user can escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

33) Input validation error

EUVDB-ID: #VU90852

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47495

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the drivers/net/usb/usbnet.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

34) Buffer overflow

EUVDB-ID: #VU91197

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47496

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the tls_err_abort(), tls_tx_records(), tls_push_record(), tls_sw_recvmsg() and tls_sw_splice_read() functions in net/tls/tls_sw.c. A local user can escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

35) Out-of-bounds read

EUVDB-ID: #VU90276

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47497

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the nvmem_shift_read_buffer_in_place() function in drivers/nvmem/core.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

36) Use-after-free

EUVDB-ID: #VU90050

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47500

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the mma8452_trigger_setup() function in drivers/iio/accel/mma8452.c. A local user can escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

37) Use-after-free

EUVDB-ID: #VU90051

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47505

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the POLLFREE() function in include/uapi/asm-generic/poll.h, within the aio_poll(), aio_poll_complete_work(), aio_poll_cancel(), aio_poll_wake() and aio_poll_queue_proc() functions in fs/aio.c. A local user can escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

38) Use-after-free

EUVDB-ID: #VU90052

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47506

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the hash_delegation_locked(), unhash_delegation_locked() and nfsd4_cb_recall_prepare() functions in fs/nfsd/nfs4state.c. A local user can escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

39) Buffer overflow

EUVDB-ID: #VU92005

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47511

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the snd_pcm_hw_param_value_min() and snd_pcm_oss_period_size() functions in sound/core/oss/pcm_oss.c. A local user can escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

40) Memory leak

EUVDB-ID: #VU89924

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47516

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the nfp_cpp_area_cache_add() function in drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

41) NULL pointer dereference

EUVDB-ID: #VU90390

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47522

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the bigben_worker() function in drivers/hid/hid-bigbenff.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

42) Memory leak

EUVDB-ID: #VU90437

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47527

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the uart_tty_port_shutdown() function in drivers/tty/serial/serial_core.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

43) Information disclosure

EUVDB-ID: #VU91325

Risk: Low

CVSSv3.1: 2.9 [AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47538

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to information disclosure within the rxrpc_create_peer(), rxrpc_lookup_peer(), __rxrpc_put_peer() and rxrpc_put_peer_locked() functions in net/rxrpc/peer_object.c. A local user can gain access to sensitive information.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

44) NULL pointer dereference

EUVDB-ID: #VU90396

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47542

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the qlcnic_83xx_add_rings() function in drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

45) Buffer overflow

EUVDB-ID: #VU93242

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52655

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the aqc111_rx_fixup() function in drivers/net/usb/aqc111.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

46) NULL pointer dereference

EUVDB-ID: #VU90401

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47562

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ice_vsi_alloc_arrays() function in drivers/net/ethernet/intel/ice/ice_lib.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

47) Integer underflow

EUVDB-ID: #VU91665

Risk: Low

CVSSv3.1: 6.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47563

CWE-ID: CWE-191 - Integer underflow

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer underflow within the ice_prepare_xdp_rings() and ice_xdp_setup_prog() functions in drivers/net/ethernet/intel/ice/ice_main.c. A local user can execute arbitrary code.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

48) Resource management error

EUVDB-ID: #VU93588

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47565

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the _scsih_ublock_io_device() function in drivers/scsi/mpt3sas/mpt3sas_scsih.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

49) Information disclosure

EUVDB-ID: #VU64136

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-20132

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output in the USB HID component in Linux Kernel. A local user can trigger the vulnerability to gain access to potentially sensitive information.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

50) Improper locking

EUVDB-ID: #VU92028

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48673

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the smc_wr_rx_process_cqes(), smc_wr_free_link() and smc_wr_create_link() functions in net/smc/smc_wr.c, within the smcr_link_init() function in net/smc/smc_core.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

51) Improper locking

EUVDB-ID: #VU90810

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-0160

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the __sock_map_delete() and sock_hash_delete_elem() functions in net/core/sock_map.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

52) Use-after-free

EUVDB-ID: #VU75448

Risk: Low

CVSSv3.1: 7.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2023-1829

CWE-ID: CWE-416 - Use After Free

Exploit availability: Yes

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the tcindex_delete() function. A local user can trigger a use-after-free error and execute arbitrary code with root privileges.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

53) Use-after-free

EUVDB-ID: #VU82306

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-4244

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the Linux kernel netfilter: nf_tables component. A local user can trigger a use-after-free error and execute arbitrary code with elevated privileges.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

54) Input validation error

EUVDB-ID: #VU94149

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52433

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the __nft_rbtree_insert() function in net/netfilter/nft_set_rbtree.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

55) Memory leak

EUVDB-ID: #VU89385

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52581

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform DoS attack on the target system.

The vulnerability exists due memory leak within the nft_trans_gc_space() function in net/netfilter/nf_tables_api.c. A local user can force the system to leak memory and perform denial of service attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

56) Improper locking

EUVDB-ID: #VU91538

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52591

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the reiserfs_rename() function in fs/reiserfs/namei.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

57) Resource management error

EUVDB-ID: #VU93257

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52654

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the scm_fp_copy() function in net/core/scm.c, within the io_finish_async() and io_sqe_files_register() functions in fs/io_uring.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

58) Use-after-free

EUVDB-ID: #VU67513

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-2938

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in Linux kernel implementation of Pressure Stall Information. A local user can trigger a use-after-free error and execute arbitrary code with elevated privileges.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

59) Buffer overflow

EUVDB-ID: #VU92976

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48760

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the usb_kill_urb() and usb_poison_urb() functions in drivers/usb/core/urb.c, within the __usb_hcd_giveback_urb() function in drivers/usb/core/hcd.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

60) Improper error handling

EUVDB-ID: #VU90930

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47482

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the batadv_tt_init() function in net/batman-adv/translation-table.c, within the batadv_nc_mesh_init() function in net/batman-adv/network-coding.c, within the batadv_mesh_init() function in net/batman-adv/main.c, within the batadv_bla_init() function in net/batman-adv/bridge_loop_avoidance.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

61) Out-of-bounds read

EUVDB-ID: #VU93519

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-37371

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when handling GSS message token. A remote attacker can send specially crafted token to the application, trigger an out-of-bounds read error and read contents of memory on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

62) NULL pointer dereference

EUVDB-ID: #VU89711

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-33600

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error when nscd cache fails to add a not-found netgroup response to the cache. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

63) Allocation of Resources Without Limits or Throttling

EUVDB-ID: #VU89710

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-33601

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to the Name Service Cache Daemon (nscd) can terminate the service during its startup. A local use can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

64) Buffer overflow

EUVDB-ID: #VU89709

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-33602

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to netgroup cache assumes NSS callback is using in-buffer strings in nscd binary. A remote attacker can trigger memory corruption and perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

65) UNIX symbolic link following

EUVDB-ID: #VU92075

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35235

CWE-ID: CWE-61 - UNIX Symbolic Link (Symlink) Following

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a symlink following issue. A local user can create a specially crafted symbolic link to a critical file on the system and make it world-writable.

Successful exploitation of this vulnerability may result in privilege escalation.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

66) Resource exhaustion

EUVDB-ID: #VU86383

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-4408

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when parsing DNS messages. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

67) Resource exhaustion

EUVDB-ID: #VU86377

Risk: Medium

CVSSv3.1: 6.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2023-50387

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: Yes

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation when processing DNSSEC related records. A remote attacker can trigger resource exhaustion by forcing the DNS server to query a specially crafted DNSSEC zone and perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

68) Resource exhaustion

EUVDB-ID: #VU86378

Risk: Medium

CVSSv3.1: 6.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2023-50868

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: Yes

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation when processing DNSSEC related records. A remote attacker can trigger resource exhaustion by forcing the DNS server to query a specially crafted DNSSEC zone and perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

69) Reachable Assertion

EUVDB-ID: #VU86382

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-5517

CWE-ID: CWE-617 - Reachable Assertion

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a reachable assertion when querying RFC 1918 reverse zones. A remote attacker can send a specially crafted DNS query and perform a denial of service attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

70) Resource exhaustion

EUVDB-ID: #VU86379

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-6516

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when processing specific recursive patterns. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack against the DNS resolver.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

71) Resource management error

EUVDB-ID: #VU94710

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-1737

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within the application when handling a very large number of RRs. Resolver caches and authoritative zone databases that hold significant numbers of RRs for the same hostname (of any RTYPE) can suffer from degraded performance as content is being added or updated, and also when handling client queries for this name.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

72) Resource exhaustion

EUVDB-ID: #VU94711

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-1975

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. If a server hosts a zone containing a "KEY" Resource Record, or a resolver DNSSEC-validates a "KEY" Resource Record from a DNSSEC-signed domain in cache, a client can exhaust resolver CPU resources by sending a stream of SIG(0) signed requests.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

73) Input validation error

EUVDB-ID: #VU93518

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-37370

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

74) Input validation error

EUVDB-ID: #VU88228

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-46842

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a malicious guest to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of register values when invoking a hypercall. A malicious HVM or PVH guest can pass specially crafted input to the hypervisor and perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

75) Buffer overflow

EUVDB-ID: #VU88822

Risk: High

CVSSv3.1: 9.1 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C]

CVE-ID: CVE-2024-2961

CWE-ID: CWE-119 - Memory corruption

Exploit availability: Yes

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the iconv() function when converting string to the ISO-2022-CN-EXT character set. A remote attacker can pass specially crafted input to the application, trigger a 4 byte buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, a fully functional exploit for this vulnerability is available.

76) Race condition

EUVDB-ID: #VU87374

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-2193

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a speculative race condition. A local user can exploit the race and gain unauthorized access to contents of arbitrary host memory, including memory assigned to other guests.

The vulnerability was dubbed GhostRace.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

77) Processor optimization removal or modification of security-critical code

EUVDB-ID: #VU88374

Risk: Medium

CVSSv3.1: 7.8 [CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-2201

CWE-ID: CWE-1037 - Processor optimization removal or modification of security-critical code

Exploit availability: No

The vulnerability allows a malicious guest to escalate privileges on the system.

The vulnerability exists due to native branch history injection on x86 systems. A malicious guest can infer the contents of arbitrary host memory, including memory assigned to other guests and compromise the affected system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

78) Type confusion

EUVDB-ID: #VU88372

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-31142

CWE-ID: CWE-843 - Type confusion

Exploit availability: No

The vulnerability allows a malicious guest to escalate privileges on the system.

The vulnerability exists due to a logical error caused by a branch type confusion when implementing fixes for the following vulnerabilities:

#VU65219 (CVE-2022-23816)
#VU65204 (CVE-2022-23825)
#VU65205 (CVE-2022-29900)
#VU79263 (CVE-2023-20569)

A malicious guest can gain access to sensitive information and escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

79) Improper locking

EUVDB-ID: #VU94499

Risk: Medium

CVSSv3.1: 5.9 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-31143

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a malicious guest to perform a denial of service (DoS) attack.

The vulnerability exists due to double unlock in x86 guest IRQ handling. An optional feature of PCI MSI called "Multiple Message" allows a device to use multiple consecutive interrupt vectors. A malicious guest can crash the hypervisor.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

80) Improper input validation

EUVDB-ID: #VU94559

Risk: Low

CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-21131

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Hotspot component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

81) Improper input validation

EUVDB-ID: #VU94560

Risk: Low

CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-21138

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the Hotspot component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

82) Improper input validation

EUVDB-ID: #VU94557

Risk: Medium

CVSSv3.1: 4.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-21140

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Hotspot component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

83) Improper input validation

EUVDB-ID: #VU94558

Risk: Low

CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-21144

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the Concurrency component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

84) Improper input validation

EUVDB-ID: #VU94556

Risk: Medium

CVSSv3.1: 4.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-21145

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the 2D component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

85) Improper input validation

EUVDB-ID: #VU94555

Risk: Medium

CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-21147

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Hotspot component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

86) Resource exhaustion

EUVDB-ID: #VU87538

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-28180

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when decompressing JWE with Decrypt or DecryptMulti. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

87) Stack-based buffer overflow

EUVDB-ID: #VU89712

Risk: High

CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-33599

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in nscd binary. A remote unauthenticated attacker can exhaust the nscd fixed size cache to trigger a stack-based buffer overflow and execute arbitrary code on the target system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

88) Out-of-bounds write

EUVDB-ID: #VU27882

Risk: High

CVSSv3.1: 7.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2020-12762

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input in the "printbuf_memappend". A remote attacker can create a specially crafted JSON file, trick the victim into opening it using the affected software, trigger out-of-bounds write and execute arbitrary code on the target system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

89) Use-after-free

EUVDB-ID: #VU92899

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48771

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the vmw_kms_helper_buffer_finish() function in drivers/gpu/drm/vmwgfx/vmwgfx_kms.c, within the vmw_fence_event_ioctl() function in drivers/gpu/drm/vmwgfx/vmwgfx_fence.c, within the vmw_execbuf_fence_commands(), vmw_execbuf_copy_fence_user() and vmw_execbuf_process() functions in drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c. A local user can escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

90) Improper locking

EUVDB-ID: #VU90735

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36894

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the ffs_user_copy_worker() and ffs_epfile_async_io_complete() functions in drivers/usb/gadget/function/f_fs.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

91) Improper Verification of Cryptographic Signature

EUVDB-ID: #VU83116

Risk: Medium

CVSSv3.1: 6.1 [CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C]

CVE-ID: CVE-2023-24023

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

Exploit availability: No

The vulnerability allows a remote attacker to perform a MitM attack.

The vulnerability exists due to improper verification of cryptographic signature in bluetooth implementation. A remote attacker with physical proximity to the system can perform MitM attack and potentially compromise the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

92) Use-after-free

EUVDB-ID: #VU90064

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52707

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the psi_trigger_destroy() function in kernel/sched/psi.c. A local user can escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

93) Use-after-free

EUVDB-ID: #VU90068

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52752

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the seq_printf() and spin_unlock() functions in fs/smb/client/cifs_debug.c. A local user can escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

94) Spoofing attack

EUVDB-ID: #VU89895

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52881

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

Exploit availability: No

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to an error within the tcp_ack() function in net/ipv4/tcp_input.c, which can result in system accepting ACK responses for bytes that were never sent. A remote attacker can perform spoofing attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

95) Integer underflow

EUVDB-ID: #VU91672

Risk: Low

CVSSv3.1: 6.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26921

CWE-ID: CWE-191 - Integer underflow

Exploit availability: No

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer underflow within the nf_ct_frag6_queue() and nf_ct_frag6_gather() functions in net/ipv6/netfilter/nf_conntrack_reasm.c, within the ip_frag_queue() and ip_defrag() functions in net/ipv4/ip_fragment.c, within the FRAG_CB(), inet_frag_queue_insert(), inet_frag_reasm_prepare(), EXPORT_SYMBOL() and inet_frag_reasm_finish() functions in net/ipv4/inet_fragment.c. A local user can execute arbitrary code.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

96) Improper locking

EUVDB-ID: #VU92035

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26923

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper locking within the unix_gc() function in net/unix/garbage.c due to garbage collector does not take into account the risk of embryo getting enqueued during the garbage collection. A local user can execute arbitrary code with elevated privileges.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

97) Use-after-free

EUVDB-ID: #VU90167

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35789

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ieee80211_change_station() function in net/mac80211/cfg.c. A local user can escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

98) Use-after-free

EUVDB-ID: #VU90150

Risk: Medium

CVSSv3.1: 5 [AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35861

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error within the cifs_signal_cifsd_for_reconnect() function in fs/smb/client/connect.c. A remote non-authenticated attacker can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

99) Use-after-free

EUVDB-ID: #VU90152

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35862

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error within the smb2_is_network_name_deleted() function in fs/smb/client/smb2ops.c. A remote non-authenticated attacker can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

100) Use-after-free

EUVDB-ID: #VU90149

Risk: Medium

CVSSv3.1: 5 [AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35864

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error within the smb2_is_valid_lease_break() function in fs/smb/client/smb2misc.c. A remote non-authenticated attacker can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

101) NULL pointer dereference

EUVDB-ID: #VU90508

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35878

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the of_modalias() function in drivers/of/module.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

102) Use-after-free

EUVDB-ID: #VU92212

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-35950

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the drm_client_modeset_probe() function in drivers/gpu/drm/drm_client_modeset.c. A local user can escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

103) Use-after-free

EUVDB-ID: #VU90047

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36904

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the tcp_twsk_unique() function in net/ipv4/tcp_ipv4.c. A local user can escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

104) Resource exhaustion

EUVDB-ID: #VU87685

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-0450

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the zipfile module does not properly control consumption of internal resources when extracting files from a zip archive. A remote attacker can pass a specially crafted archive aka zip-bomb to the application, trigger resource exhaustion and perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

105) Double Free

EUVDB-ID: #VU90885

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36940

CWE-ID: CWE-415 - Double Free

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the pinctrl_enable() function in drivers/pinctrl/core.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

106) Improper privilege management

EUVDB-ID: #VU93734

Risk: Low

CVSSv3.1: 3.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-36964

CWE-ID: CWE-269 - Improper Privilege Management

Exploit availability: No

The vulnerability allows a local user to read and manipulate data.

The vulnerability exists due to improperly imposed permissions within the p9mode2perm() function in fs/9p/vfs_inode.c. A local user can read and manipulate data.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

107) Buffer overflow

EUVDB-ID: #VU92376

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-38541

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the of_modalias() function in drivers/of/module.c. A local user can escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

108) Use-after-free

EUVDB-ID: #VU92306

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-38545

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the alloc_cqc(), free_cqc() and hns_roce_cq_event() functions in drivers/infiniband/hw/hns/hns_roce_cq.c. A local user can escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

109) Out-of-bounds read

EUVDB-ID: #VU92328

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-38559

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the qedf_dbg_debug_cmd_write() function in drivers/scsi/qedf/qedf_debugfs.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

110) Out-of-bounds read

EUVDB-ID: #VU92327

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-38560

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the bfad_debugfs_write_regrd() and bfad_debugfs_write_regwr() functions in drivers/scsi/bfa/bfad_debugfs.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

111) Use-after-free

EUVDB-ID: #VU86052

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-25062

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in xmlValidatePopElement when using the XML Reader interface with DTD validation and XInclude expansion enabled. A remote attacker can pass a specially crafted XML document to the application, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

112) Race condition

EUVDB-ID: #VU6900

Risk: Low

CVSSv3.1: 5.5 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-6512

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

The vulnerability allows a local user to bypass certain security restrictions.

the vulnerability exists due to a race condition in rmtree() and remove_tree() functions within the File-Path module for Perl. A local user can set a mode on arbitrary files via vectors involving directory-permission loosening logic.

Successful exploitation of the vulnerability may allow an attacker to escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

113) Heap-based buffer over-read

EUVDB-ID: #VU11834

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-6798

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a local attacker to obtain potentially sensitive information or execute arbitrary code on the target system.

The weakness exists due to heap-based buffer over-read. A local attacker can exploit a specially crafted locale dependent regular expression, trigger memory corruption and gain access to potentially sensitive information or run Perl code.

Successful exploitation of the vulnerability may result in system compromise.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

114) Heap-based buffer overflow

EUVDB-ID: #VU11835

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-6913

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

The vulnerability allows a local attacker to cause DoS condition or execute arbitrary code on the target system.

The weakness exists due to heap-based buffer overflow. A local attacker can exploit a specially crafted pack() function, trigger memory corruption and cause the service to crash or run Perl code.

Successful exploitation of the vulnerability may result in system compromise.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

115) Cross-site scripting

EUVDB-ID: #VU102857

Risk: Medium

CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-251

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

116) Use-after-free

EUVDB-ID: #VU89861

Risk: Medium

CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-4741

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error within the SSL_free_buffers() function. A remote attacker can trigger a use-after-free error and perform a denial of service (DoS) attack.

Note, the vulnerability affects only applications that call the vulnerable function.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

117) Resource exhaustion

EUVDB-ID: #VU86230

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52425

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when parsing large tokens. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

118) Double free

EUVDB-ID: #VU90920

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47483

CWE-ID: CWE-415 - Double Free

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a double free error within the regcache_rbtree_insert_to_block() function in drivers/base/regmap/regcache-rbtree.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

119) Memory leak

EUVDB-ID: #VU89941

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47473

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak in drivers/scsi/qla2xxx/qla_bsg.c. A local user can crash the kernel.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

120) Resource management error

EUVDB-ID: #VU93455

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47229

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the advk_pcie_wait_pio(), advk_pcie_rd_conf() and advk_pcie_wr_conf() functions in drivers/pci/host/pci-aardvark.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

121) Memory leak

EUVDB-ID: #VU90005

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26840

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the kmem_cache_free() and cachefiles_daemon_unbind() functions in fs/cachefiles/bind.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

122) Use-after-free

EUVDB-ID: #VU90194

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26852

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ip6_route_multipath_add() and list_for_each_entry_safe() functions in net/ipv6/route.c. A local user can escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

123) Race condition within a thread

EUVDB-ID: #VU91434

Risk: Low

CVSSv3.1: 2.9 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26862

CWE-ID: CWE-366 - Race Condition within a Thread

Exploit availability: No

The vulnerability allows a local user to manipulate data.

The vulnerability exists due to a data race within the packet_setsockopt() and packet_getsockopt() functions in net/packet/af_packet.c, within the dev_queue_xmit_nit() function in net/core/dev.c. A local user can manipulate data.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

124) Use-after-free

EUVDB-ID: #VU90197

Risk: Low

CVSSv3.1: 6.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26898

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the tx() function in drivers/block/aoe/aoenet.c, within the aoecmd_cfg_pkts() function in drivers/block/aoe/aoecmd.c. A local user can escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

125) NULL pointer dereference

EUVDB-ID: #VU92070

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26903

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the rfcomm_process_rx() function in net/bluetooth/rfcomm/core.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

126) Improper error handling

EUVDB-ID: #VU92944

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26906

CWE-ID: CWE-388 - Error Handling

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling within the copy_from_kernel_nofault_allowed() function in arch/x86/mm/maccess.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

127) Use-after-free

EUVDB-ID: #VU90178

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-27043

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the dvb_register_device() function in drivers/media/dvb-core/dvbdev.c. A local user can escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

128) Out-of-bounds read

EUVDB-ID: #VU63913

Risk: Low

CVSSv3.1: 5.3 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-3743

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service attack.

The vulnerability exists due to a boundary condition in the Qualcomm IPC router protocol in the Linux kernel. A local user can gain access to out-of-bounds memory to leak internal kernel information or perform a denial of service attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

129) Use-after-free

EUVDB-ID: #VU61097

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-39698

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in Linux kernel. A local user can run a specially crafted program to trigger the use-after-free error and execute arbitrary code with elevated privileges.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

130) Unchecked Return Value

EUVDB-ID: #VU63921

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-43056

CWE-ID: CWE-252 - Unchecked Return Value

Exploit availability: No

The vulnerability allows a local user to perform a denial of service attack.

The vulnerability exists due to an arch/powerpc/kvm/book3s_hv_rmhandlers.S implementation error when handling SRR1 register values. A local user can perform a denial of service attack, when the host is running on Power8.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

131) Memory leak

EUVDB-ID: #VU90019

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47104

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the qib_user_sdma_queue_pkts() function in drivers/infiniband/hw/qib/qib_user_sdma.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

132) NULL pointer dereference

EUVDB-ID: #VU90462

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47220

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the dwc3_remove() function in drivers/usb/dwc3/core.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

133) Memory leak

EUVDB-ID: #VU89946

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47231

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the mcba_usb_start() and mcba_usb_open() functions in drivers/net/can/usb/mcba_usb.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

134) NULL pointer dereference

EUVDB-ID: #VU90596

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26744

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the module_param() function in drivers/infiniband/ulp/srpt/ib_srpt.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

135) Memory leak

EUVDB-ID: #VU91632

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47236

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the eem_tx_fixup() function in drivers/net/usb/cdc_eem.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

136) Memory leak

EUVDB-ID: #VU89949

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47239

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the smsc75xx_bind() and smsc75xx_unbind() functions in drivers/net/usb/smsc75xx.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

137) Out-of-bounds read

EUVDB-ID: #VU90290

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47240

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the qrtr_endpoint_post() function in net/qrtr/qrtr.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

138) Information disclosure

EUVDB-ID: #VU91342

Risk: Low

CVSSv3.1: 2.9 [AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47246

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to information disclosure within the mlx5_hairpin_unpair_peer_sq(), mlx5_hairpin_unpair_queues() and mlx5_core_hairpin_destroy() functions in drivers/net/ethernet/mellanox/mlx5/core/transobj.c, within the mlx5e_tc_hairpin_update_dead_peer() function in drivers/net/ethernet/mellanox/mlx5/core/en_tc.c. A local user can gain access to sensitive information.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

139) Resource management error

EUVDB-ID: #VU93253

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47252

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the batadv_iv_ogm_emit() function in net/batman-adv/bat_iv_ogm.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

140) Use-after-free

EUVDB-ID: #VU90086

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47254

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the __acquires() and gfs2_scan_glock_lru() functions in fs/gfs2/glock.c. A local user can escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

141) Information disclosure

EUVDB-ID: #VU91341

Risk: Low

CVSSv3.1: 2.9 [AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47255

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to information disclosure within the kvm_lapic_reg_read() function in arch/x86/kvm/lapic.c. A local user can gain access to sensitive information.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

142) Use-after-free

EUVDB-ID: #VU90092

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47259

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the nfs4_init_client() function in fs/nfs/nfs4client.c. A local user can escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

143) NULL pointer dereference

EUVDB-ID: #VU91230

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47260

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the nfs_get_client() function in fs/nfs/client.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

144) Improper Initialization

EUVDB-ID: #VU93607

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47261

CWE-ID: CWE-665 - Improper Initialization

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper initialization within the destroy_cq_user(), create_cq_kernel() and resize_kernel() functions in drivers/infiniband/hw/mlx5/cq.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

145) NULL pointer dereference

EUVDB-ID: #VU90474

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47267

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the usb_assign_descriptors() function in drivers/usb/gadget/config.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

146) NULL pointer dereference

EUVDB-ID: #VU90477

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47269

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the dwc3_wIndex_to_dep() function in drivers/usb/dwc3/ep0.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

147) Memory leak

EUVDB-ID: #VU91650

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26816

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the print_absolute_relocs() function in arch/x86/tools/relocs.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

148) Use-after-free

EUVDB-ID: #VU90214

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26739

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the tcf_mirred_to_dev() function in net/sched/act_mirred.c. A local user can escalate privileges on the system.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

149) Out-of-bounds read

EUVDB-ID: #VU90294

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47274

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the trace_event_buffer_lock_reserve() function in kernel/trace/trace.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

150) NULL pointer dereference

EUVDB-ID: #VU92072

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47206

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the ohci_hcd_tmio_drv_probe() function in drivers/usb/host/ohci-tmio.c. A local user can perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

151) Out-of-bounds read

EUVDB-ID: #VU88889

Risk: Medium

CVSSv3.1: 4.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-46955

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the ovs_fragment() function in net/openvswitch/actions.c when running openvswitch on kernels built with KASAN. A remote attacker can send specially crafted IPv4 packets to the system, trigger an out-of-bounds read error and read contents of memory on the system or crash the kernel.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

152) Improper locking

EUVDB-ID: #VU89745

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47041

CWE-ID: CWE-667 - Improper Locking

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the nvmet_tcp_state_change() function in drivers/nvme/target/tcp.c. An remote attacker can send specially crafted packets to the system and perform a denial of service (DoS) attack.

Install update from vendor's website.

EMC Cloud Tiering Appliance: before 13.2.0.2.31

• cpe:2.3:a:dell:emc_cloud_tiering_appliance:*:*:*:*:*:*:*:*

http://www.dell.com/support/kbdoc/nl-nl/000228228/dsa-2024-378-security-update-for-dell-cloud-tiering-appliance-for-multiple-third-party-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

153) Memory leak

EUVDB-ID: #VU90027

Risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-47074

CWE-ID: CWE-401 - Missing release of memory after effective lifetime