PT-2022-22169 · Dell · Dell Powerscale Onefs

Published 2022-10-21 · Updated 2022-10-24 · CVE-2022-34438

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell PowerScale OneFS versions 8.2.x through 9.4.0.x

Description A privilege context switching error exists, allowing a local authenticated malicious user with high privileges to potentially exploit this issue, leading to full system compromise. This affects compliance mode clusters.

Recommendations For Dell PowerScale OneFS versions 8.2.x through 9.4.0.x, update to a version that contains a fix for this privilege context switching error to prevent full system compromise. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2022-34438

Affected Products

Dell Powerscale Onefs

References · 4

• https://dell.com/support/kbdoc/en-us/000204053/dsa-2022-245-dell-emc-powerscale-onefs-security-update-for-multiple-security-updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-34438 · Security Note
• https://osv.dev/vulnerability/CVE-2022-34438 · Vendor Advisory
• https://t.me/cibsecurity/51953 · Telegram Post