NULL pointer dereference in Virtual RAID on CPU (VROC) - CVE-2022-29508

Vulnerability identifier: #VU76036

CSH Severity: Low

CVSS v4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-29508

CWE-ID: CWE-476

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to compromise the system.

The vulnerability exists due to a NULL pointer dereference error. A local user can gain elevated privileges on the target system.

Virtual RAID on CPU (VROC)
Precision 7820 Tower
Precision 5820 Tower
Precision 7920 Tower

Install update from vendor's website.

Virtual RAID on CPU (VROC) - update to 7.7.6.1003
Precision 7820 Tower - addressed in versions 7.7.1260.0, 7.8.0.1031
Precision 5820 Tower - addressed in versions 7.7.1260.0, 7.8.0.1031
Precision 7920 Tower - addressed in versions 7.7.1260.0, 7.8.0.1031

• https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00692.html

• Multiple vulnerabilities in Intel VROC
• Multiple vulnerabilities in Dell Client Precision Tower Intel VROC