CVE-2022-22555
published 2022-07-21CVE-2022-22555: Dell EMC PowerStore, contains an OS command injection Vulnerability. A locally authenticated attacker could potentially exploit this vulnerability, leading to…
PriorityP432medium6.7CVSS 3.1
AVLACLPRHUINSUCHIHAH
EPSS
0.86%
53.8th percentile
Dell EMC PowerStore, contains an OS command injection Vulnerability. A locally authenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the PowerStore underlying OS, with the privileges of the vulnerable application. Exploitation may lead to an elevation of privilege.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dell | emc_powerstore_1200t_firmware | < 3.0.0.0-1732745 | 3.0.0.0-1732745 |
| dell | emc_powerstore_3200t_firmware | < 3.0.0.0-1732745 | 3.0.0.0-1732745 |
| dell | emc_powerstore_500t_firmware | < 3.0.0.0-1732745 | 3.0.0.0-1732745 |
| dell | emc_powerstore_5200t_firmware | < 3.0.0.0-1732745 | 3.0.0.0-1732745 |
| dell | emc_powerstore_9200t_firmware | < 3.0.0.0-1732745 | 3.0.0.0-1732745 |
| dell | powerstore | >= unspecified < X and T models | X and T models |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Kernel
ipc, msg: Use dedicated slab buckets for alloc_msg()
kernel_security·2024-07-01·CVSS 7.0
CVE-2021-26708 [HIGH] ipc, msg: Use dedicated slab buckets for alloc_msg()
ipc, msg: Use dedicated slab buckets for alloc_msg()
The msg subsystem is a common target for exploiting[1][2][3][4][5][6][7]
use-after-free type confusion flaws in the kernel for both read and write
primitives. Avoid having a user-controlled dynamically-size allocation
share the global kmalloc cache by using a separate set of kmalloc buckets
via the kmem_buckets API.
Link: https://blog.hacktivesecurity.com/index.php/2022/06/13/linux-kernel-exploit-development-1day-case-study/ [1]
Link: https://hardenedvault.net/blog/2022-11-13-msg_msg-recon-mitigation-ved/ [2]
Link: https://www.willsroot.io/2021/08/corctf-2021-fire-of-salvation-writeup.html [3]
Link: https://a13xp0p0v.github.io/2021/02/09/CVE-2021-26708.html [4]
Link: https://google.github.io/security-research/pocs/linux/cve-2021-22555/
GHSA
GHSA-hr58-gmfj-355v: Dell EMC PowerStore, contains an OS command injection Vulnerability
ghsa_unreviewed·2022-07-22
CVE-2022-22555 [MEDIUM] CWE-78 GHSA-hr58-gmfj-355v: Dell EMC PowerStore, contains an OS command injection Vulnerability
Dell EMC PowerStore, contains an OS command injection Vulnerability. A locally authenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the PowerStore underlying OS, with the privileges of the vulnerable application. Exploitation may lead to an elevation of privilege.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-07-21
Published