Incorrect default permissions in Virtual RAID on CPU (VROC) - CVE-2022-30338

Vulnerability identifier: #VU76035

CSH Severity: Low

CVSS v4: 5.4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-30338

CWE-ID: CWE-276

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect default permissions for files and folders that are set by the application. A local user can gain elevated privileges on the target system.

Virtual RAID on CPU (VROC)
Precision 7820 Tower
Precision 5820 Tower
Precision 7920 Tower

Install updates from vendor's website.

Virtual RAID on CPU (VROC) - update to 7.7.6.1003
Precision 7820 Tower - addressed in versions 7.7.1260.0, 7.8.0.1031
Precision 5820 Tower - addressed in versions 7.7.1260.0, 7.8.0.1031
Precision 7920 Tower - addressed in versions 7.7.1260.0, 7.8.0.1031

• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00692.html

• Multiple vulnerabilities in Intel VROC
• Multiple vulnerabilities in Dell Client Precision Tower Intel VROC