Dell SmartFabric OS10 (execution with unnecessary privileges): Low-privileged local attacker reaches command execution

Impact

Low-privileged local attacker reaches command execution through an over-privileged component of the switch OS.

Who can reach it

Local low-privilege switch access.

What to do

Upgrade OS10 per DSA-2024-425.

References

Related entries

• Dell SmartFabric OS10 (execution with unnecessary privileges): A low-privileged attacker escalates through an OS10CVE-2024-48013 · Dell SmartFabric OS10 (execution with unnecessary privileges)High
• Dell SmartFabric OS10 (command injection): Command injection from a low-privileged local account leading to codeCVE-2024-49557 · Dell SmartFabric OS10 (command injection)High
• Dell SmartFabric OS10 (improper privilege management): A low-privileged local attacker elevates privileges on the switchCVE-2024-49558 · Dell SmartFabric OS10 (improper privilege management)High
• Dell SmartFabric OS10 (command injection): A low-privileged local attacker executes commands on the switch OSCVE-2024-49560 · Dell SmartFabric OS10 (command injection)High
• Dell SmartFabric OS10 (incorrect privilege assignment): Local low-privilege attacker escalates privileges on the switchCVE-2024-49561 · Dell SmartFabric OS10 (incorrect privilege assignment)High
• Linux kernel (drivers/net/ethernet/mellanox/mlx5/core): When a DMA mapping fails on the multi-packet transmit path, theCVE-2024-50001 · Linux kernel (drivers/net/ethernet/mellanox/mlx5/core)High