PT-2022-15887 · Dell · Dell Powerscale Onefs

Published 2022-04-12 · Updated 2022-04-20 · CVE-2022-23159

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Dell PowerScale OneFS versions 8.2.2 through 9.3.0.x

Description The issue is related to a missing release of memory after its effective lifetime, which can be exploited by an authenticated user with specific privileges, such as ISI PRIV LOGIN SSH, ISI PRIV LOGIN CONSOLE, and ISI PRIV AUTH PROVIDERS. This can lead to a Denial-Of-Service and also impact a cluster in Compliance mode.

Recommendations For Dell PowerScale OneFS versions 8.2.2 through 9.3.0.x, update to a newer version at the earliest opportunity to resolve the issue. As a temporary workaround, consider restricting access to the system for users with ISI PRIV LOGIN SSH, ISI PRIV LOGIN CONSOLE, and ISI PRIV AUTH PROVIDERS privileges until the update is applied.

Fix

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

CVE-2022-23159

Affected Products

Dell Powerscale Onefs

References · 5

• https://osv.dev/vulnerability/CVE-2022-23159 · Vendor Advisory
• https://dell.com/support/kbdoc/000196009 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23159 · Security Note
• https://t.me/cibsecurity/40668 · Telegram Post
• https://t.me/cvenotify/28780 · Telegram Post