Vulnerability · Published Apr 12, 2022 · Assigned by dell

CVE-2022-23159

Medium 4.8

In plain English

A medium-severity memory leak in PowerScale OneFS from Dell. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).

Severity (CVSS 3.1)4.8Medium

Exploit odds (30 days)0.6%top 50.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Dell PowerScale OneFS, 8.2.2 - 9.3.0.x, contain a missing release of memory after effective lifetime vulnerability. An authenticated user with ISI_PRIV_LOGIN_SSH and/or ISI_PRIV_LOGIN_CONSOLE and ISI_PRIV_AUTH_PROVIDERS privileges could exploit this vulnerability, leading to a Denial-Of-Service. This can also impact a cluster in Compliance mode. Dell recommends to update at the earliest opportunity.

Affected products (as reported)

Vendor	Product	Versions
Dell	PowerScale OneFS	8.2.2 - 9.3.0.x

Weakness: CWE-401 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

References

https://www.dell.com/support/kbdoc/000196009 x_refsource_MISC