Multiple vulnerabilities in IBM Storage Protect Plus Server

1) NULL pointer dereference

EUVDB-ID: #VU71537

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-3106

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the ef100_update_stats() function in drivers/net/ethernet/sfc/ef100_nic.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Spectrum Protect Plus: 10.1.0.0 - 10.1.14

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_spectrum_protect_plus:10.1.0.0:*:*:*:*:*:*:
• cpe:2.3:a:ibm_corporation:ibm_spectrum_protect_plus:10.1.1.0:*:*:*:*:*:*:
• cpe:2.3:a:ibm_corporation:ibm_spectrum_protect_plus:10.1.2.0:*:*:*:*:*:*:

External links

http://www.ibm.com/support/pages/node/7005925

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Unchecked Return Value

EUVDB-ID: #VU71539

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-3108

CWE-ID: CWE-252 - Unchecked Return Value

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to unchecked return value within the kfd_parse_subtype_iolink() function in drivers/gpu/drm/amd/amdkfd/kfd_crat.c. A local user can crash the kernel.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Spectrum Protect Plus: 10.1.0.0 - 10.1.14

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_spectrum_protect_plus:10.1.0.0:*:*:*:*:*:*:
• cpe:2.3:a:ibm_corporation:ibm_spectrum_protect_plus:10.1.1.0:*:*:*:*:*:*:
• cpe:2.3:a:ibm_corporation:ibm_spectrum_protect_plus:10.1.2.0:*:*:*:*:*:*:

External links

http://www.ibm.com/support/pages/node/7005925

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Out-of-bounds write

EUVDB-ID: #VU71586

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-40152

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error when processing untrusted input within the Woodstox XML parser. A remote attacker can pass a specially crafted input to the application, trigger an out-of-bounds write and crash the application.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Spectrum Protect Plus: 10.1.0.0 - 10.1.14

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_spectrum_protect_plus:10.1.0.0:*:*:*:*:*:*:
• cpe:2.3:a:ibm_corporation:ibm_spectrum_protect_plus:10.1.1.0:*:*:*:*:*:*:
• cpe:2.3:a:ibm_corporation:ibm_spectrum_protect_plus:10.1.2.0:*:*:*:*:*:*:

External links

http://www.ibm.com/support/pages/node/7005925

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) NULL pointer dereference

EUVDB-ID: #VU71536

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-3105

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the uapi_finalize() function in drivers/infiniband/core/uverbs_uapi.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Spectrum Protect Plus: 10.1.0.0 - 10.1.14

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_spectrum_protect_plus:10.1.0.0:*:*:*:*:*:*:
• cpe:2.3:a:ibm_corporation:ibm_spectrum_protect_plus:10.1.1.0:*:*:*:*:*:*:
• cpe:2.3:a:ibm_corporation:ibm_spectrum_protect_plus:10.1.2.0:*:*:*:*:*:*:

External links

http://www.ibm.com/support/pages/node/7005925

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Inconsistent interpretation of HTTP requests

EUVDB-ID: #VU67850

Risk: Medium

CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-35256

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.

The vulnerability exists due to improper validation of HTTP requests. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.

Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Spectrum Protect Plus: 10.1.0.0 - 10.1.14

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_spectrum_protect_plus:10.1.0.0:*:*:*:*:*:*:
• cpe:2.3:a:ibm_corporation:ibm_spectrum_protect_plus:10.1.1.0:*:*:*:*:*:*:
• cpe:2.3:a:ibm_corporation:ibm_spectrum_protect_plus:10.1.2.0:*:*:*:*:*:*:

External links

http://www.ibm.com/support/pages/node/7005925

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) NULL pointer dereference

EUVDB-ID: #VU71538

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-3107

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the netvsc_get_ethtool_stats() function in drivers/net/hyperv/netvsc_drv.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Spectrum Protect Plus: 10.1.0.0 - 10.1.14

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_spectrum_protect_plus:10.1.0.0:*:*:*:*:*:*:
• cpe:2.3:a:ibm_corporation:ibm_spectrum_protect_plus:10.1.1.0:*:*:*:*:*:*:
• cpe:2.3:a:ibm_corporation:ibm_spectrum_protect_plus:10.1.2.0:*:*:*:*:*:*:

External links

http://www.ibm.com/support/pages/node/7005925

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.