Dell Enterprise SONiC (OS command injection): OS command injection giving arbitrary command execution on the switch's

Impact

OS command injection giving arbitrary command execution on the switch's underlying Linux. Chained behind the authentication-bypass in the same advisory batch, an unauthenticated attacker goes from the network to root on the switch in two steps. On SONiC the 'switch' is a fairly normal Linux box with the ASIC SDK attached, so root there means arbitrary forwarding-table manipulation for every tenant on the device.

Who can reach it

Remote attacker holding high-privilege access — but see CVE-2024-45764, which supplies that access without credentials.

What to do

Same fix as the rest of DSA-2024-449: NOS image upgrade and reboot on every Dell Enterprise SONiC switch running 4.1.x or 4.2.x. Assume any device that was reachable pre-patch may hold persistence and consider a clean re-image rather than an in-place upgrade.

References