Use-after-free in Virtual RAID on CPU (VROC) - CVE-2022-29919

Vulnerability identifier: #VU76034

CSH Severity: Low

CVSS v4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-29919

CWE-ID: CWE-416

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to compromise vulnerable system.

The vulnerability exists due to a use-after-free error. A local user can gain elevated privileges on the target system.

Virtual RAID on CPU (VROC)
Precision 7820 Tower
Precision 5820 Tower
Precision 7920 Tower

Install updates from vendor's website.

Virtual RAID on CPU (VROC) - update to 7.7.6.1003
Precision 7820 Tower - addressed in versions 7.7.1260.0, 7.8.0.1031
Precision 5820 Tower - addressed in versions 7.7.1260.0, 7.8.0.1031
Precision 7920 Tower - addressed in versions 7.7.1260.0, 7.8.0.1031

• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00692.html

• Multiple vulnerabilities in Intel VROC
• Multiple vulnerabilities in Dell Client Precision Tower Intel VROC