Multiple vulnerabilities in Dell EMC Isilon OneFS



Published: 2022-11-11
Risk Low
Patch available YES
Number of vulnerabilities 3
CVE-ID CVE-2018-3640
CVE-2018-3639
CVE-2018-3620
CWE-ID CWE-362
CWE-200
Exploitation vector Local
Public exploit N/A
Vulnerable software
Subscribe 		EMC Isilon OneFS
Client/Desktop applications / Software for system administration

Vendor Dell

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Rogue System Register Read

EUVDB-ID: #VU12914

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2018-3640

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a local attacker to obtain potentially sensitive information on the target system.

The weakness exists due to race conditions in CPU cache processing. A local attacker can conduct a side-channel attack to exploit a flaw in the speculative loading of system registers to read privileged system registers

Note: the vulnerability is referred to as "Spectre variant 3A".

Mitigation

Install update from vendor's website.

Vulnerable software versions

EMC Isilon OneFS: before 8.1.2.0

CPE2.3 External links

http://www.dell.com/support/kbdoc/en-us/000153854/dsa-2019-003-dell-emc-isilon-onefs-security-update-for-multiple-multiprocessor-side-channel-vulnerabilities


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

2) Speculative Store Bypass

EUVDB-ID: #VU12911

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2018-3639

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a local attacker to obtain potentially sensitive information on the target system.

The weakness exists due to race conditions in CPU cache processing. A local attacker can conduct a side-channel attack to exploit a flaw in the speculative execution of Load and Store instructions to read privileged memory.

Note: the vulnerability is referred to as "Spectre variant 4".

Mitigation

Install update from vendor's website.

Vulnerable software versions

EMC Isilon OneFS: before 8.1.2.0

CPE2.3 External links

http://www.dell.com/support/kbdoc/en-us/000153854/dsa-2019-003-dell-emc-isilon-onefs-security-update-for-multiple-multiprocessor-side-channel-vulnerabilities


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

3) Side-channel attack

EUVDB-ID: #VU14411

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2018-3620

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a local attacker to obtain potentially sensitive information.

The vulnerability exists due to an error in systems with microprocessors utilizing speculative execution and address translations . A local attacker can trigger terminal page fault, conduct side-channel attack and gain access to potentially sensitive information residing in the L1 data cache.

Mitigation

Install update from vendor's website.

Vulnerable software versions

EMC Isilon OneFS: before 8.1.2.0

CPE2.3 External links

http://www.dell.com/support/kbdoc/en-us/000153854/dsa-2019-003-dell-emc-isilon-onefs-security-update-for-multiple-multiprocessor-side-channel-vulnerabilities


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?



###SIDEBAR###