SB2023113042 - Multiple vulnerabilities in Dell Disk Library for mainframe (DLm)
Published: November 30, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Out-of-bounds write (CVE-ID: CVE-2021-38578)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error in MdeModulePkg/Core/PiSmmCore/PiSmmCore.c. A local user trigger an out-of-bounds write and execute arbitrary code with elevated privileges.
2) Out-of-bounds write (CVE-ID: CVE-2023-25537)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error in System Management Mode. A local user can trigger an out-of-bounds write and execute arbitrary code with elevated privileges.
3) Information exposure through microarchitectural state after transient execution (CVE-ID: CVE-2022-40982)
The vulnerability allows a malicious guest to escalate privileges on the system.
The vulnerability exists due to the way data is shared between threads whereby the AVX GATHER instructions on Intel processors can forward the content of stale vector registers to dependent instructions. A malicious guest can infer data from different contexts on the same core and execute arbitrary code with elevated privileges.
4) Insufficient control flow management (CVE-ID: CVE-2022-43505)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient control flow management in the BIOS firmware. A local user can perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.