Dell Enterprise SONiC (OS command injection): OS command injection giving arbitrary command execution on the switch's

CVSS 9.1CVE-2024-45763Firmware, BMC & network fabricDSA-2024-449curated

Impact

OS command injection giving arbitrary command execution on the switch's underlying Linux. Chained behind the authentication-bypass in the same advisory batch, an unauthenticated attacker goes from the network to root on the switch in two steps. On SONiC the 'switch' is a fairly normal Linux box with the ASIC SDK attached, so root there means arbitrary forwarding-table manipulation for every tenant on the device.

Who can reach it

Remote attacker holding high-privilege access — but see CVE-2024-45764, which supplies that access without credentials.

What to do

Same fix as the rest of DSA-2024-449: NOS image upgrade and reboot on every Dell Enterprise SONiC switch running 4.1.x or 4.2.x. Assume any device that was reachable pre-patch may hold persistence and consider a clean re-image rather than an in-place upgrade.

References

https://www.dell.com/support/kbdoc/en-us/000245655/dsa-2024-449-security-update-for-dell-enterprise-sonic-distribution-vulnerabilities https://nvd.nist.gov/vuln/detail/CVE-2024-45763

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.