In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data set_new_password() hex dumps the entire buffer, which contains plaintext password data, including current and new passwords. Remove the hex dump to avoid leaking credentials.
En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: platform/x86: dell-wmi-sysman: No volcar en hexadecimal datos de contraseña en texto plano set_new_password() vuelca en hexadecimal el búfer completo, que contiene datos de contraseña en texto plano, incluyendo contraseñas actuales y nuevas. Eliminar el volcado en hexadecimal para evitar la fuga de credenciales.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
NVD-CWE-noinfo
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d23af2bd6c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d2424535f40> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d2424535d40> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d24245af940> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d23af2bd540> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d24245ad780> | Operating System |
| linux | linux_kernel | 5.11 | <built-in method update of dict object at 0x7d242455ef00> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7d23a5986e80> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7d23af2bcf80> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7d23af2bf7c0> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7d23af2bf240> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7d2424535100> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7d242455c2c0> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7d23a7f74340> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:5.11:-:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:* |