Weak password requirements in fwupd - CVE-2022-3287

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU75912

Weak password requirements in fwupd - CVE-2022-3287

Published: May 9, 2023


Vulnerability identifier: #VU75912
CSH Severity: Low
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-3287
CWE-ID: CWE-521
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to escalate privileges within the application.

The vulnerability exists due to the way the redfish plugin handles passwords. When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction. A local user can read the configuration file and gain operator privileges.


Affected software

fwupd
Oracle Linux
Anolis OS
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Juniper Secure Analytics (JSA)
fwupd-debuginfo (Red Hat package)
fwupd-debugsource (Red Hat package)
fwupd-devel (Red Hat package)
fwupd-tests-debuginfo (Red Hat package)
fwupd (Red Hat package)
fwupd
fwupd-devel
fwupd-doc

How to mitigate CVE-2022-3287

Install updates from vendor's website.

fwupd - update to 1.8.5
Juniper Secure Analytics (JSA) - update to 7.5.0 UP9 IF02
fwupd-debuginfo (Red Hat package) - update to 1.7.4-3.el8_6
fwupd-debugsource (Red Hat package) - update to 1.7.4-3.el8_6
fwupd-devel (Red Hat package) - update to 1.7.4-3.el8_6
fwupd-tests-debuginfo (Red Hat package) - update to 1.7.4-3.el8_6
fwupd (Red Hat package) - addressed in versions 1.7.8-2.el8, 1.7.8-2.el8_8, 1.8.10-2.el9
fwupd - update to 1.7.8-2.0.1
fwupd-devel - update to 1.7.8-2.0.1
fwupd-doc - update to 1.7.8-2.0.1

External References

Related Security Bulletins