Main Vulnerability Database SB2022111120

SB2022111120 - Multiple vulnerabilities in Dell EMC VxRack System Flex

Published: November 11, 2022

Security Bulletin ID SB2022111120

Severity

Low

Patch available

YES

Number of vulnerabilities 2

Exploitation vector Adjecent network

Highest impact Denial of service

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Stack-based buffer overflow (CVE-ID: CVE-2018-6981)

The vulnerability allows an adjacent attacker to execute arbitrary code on the target system.

The weakness exists due to uninitialized stack memory usage in the vmxnet3 virtual network adapter. A remote attacker can trigger memory corruption if vmxnet3 is enabled and execute arbitrary code with elevated privileges.

2) Stack-based buffer overflow (CVE-ID: CVE-2018-6982)

The vulnerability allows an adjacent attacker to obtain potentially sensitive information on the target system.

The weakness exists due to uninitialized stack memory usage in the vmxnet3 virtual network adapter. A remote attacker can trigger memory corruption if vmxnet3 is enabled and access arbitrary data.

Remediation

Install update from vendor's website.

References

https://www.dell.com/support/kbdoc/en-us/000153789/dsa-2019-008-dell-emc-vxrack-system-flex-security-update-for-vmware-vsphere-vulnerabilities