Security Bulletin: Multiple Vulnerabilities in XCC affect Cloud Pak System (CVE-2022-34884, CVE-2022-34888)

Summary

XClarity Controller (XCC) is vulnerable to Denial of Service and tampering. XCC is used by Cloud Pak System. Cloud Pak System has addressed these vulnerabilities.

Vulnerability Details

CVEID:CVE-2022-34884
**DESCRIPTION:**Lenovo XClarity Controller (XCC) is vulnerable to a denial of service, caused by a buffer overflow vulnerability in the Remote Presence subsystem. By sending a specially-crafted request, a remote authenticated attacker could overflow a buffer and cause a denial of service.
CVSS Base score: 4.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/231123 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)

CVEID:CVE-2022-34888
**DESCRIPTION:**Lenovo XClarity Controller (XCC) is vulnerable to tampering, caused by a flaw in the Remote Mount feature. By using spoofed CAN messages, a remote authenticated attacker could exploit this vulnerability to make connections to internal services that may not normally be accessible to users.
CVSS Base score: 5.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/231124 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)

Affected Products and Versions

Remediation/Fixes

Recommended solution for Cloud Pak System update XClarity Controller (XCC) with Cloud Pak System 2.3.3.6 as reported in the table below.

Workarounds and Mitigations

None