Summary
Impact: Information Disclosure. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
What version of Azure Sphere has the update that protects from this vulnerability?
All versions of Azure Sphere that are 22.07 and higher are protected from this vulnerability.
If your device is new or has not been connected to the internet for a while, connect the device to a secure, private local network with internet access and allow the device to automatically update itself. If the device is already online, verify that the operating system version 21.07 has been installed using the Azure Sphere CLI command:
azsphere device show-os-version
If the device is connected to the internet and does not yet have the latest update, check the update status with the following Azure Sphere CLI command:
azsphere device show-deployment-status
An IoT device that is running Azure Sphere and is connected to a network is automatically updated every day. This vulnerability has already been addressed so the devices are protected from this vulnerability. More information on Azure Sphere’s CVE principles can be found on https://docs.microsoft.com/en-us/azure-sphere/deployment/azure-sphere-cves
According to the CVSS metrics, successful exploitation of this vulnerability could lead to major loss of confidentiality (C:H) but have no effect on integrity (I:N) or on availability (A:N). What does that mean for this vulnerability?
This vulnerability could allow an attacker to disclose the contents of the memory location, but they cannot modify the contents or make the system unavailable.
According to the CVSS metric, the attack vector is local (AV:L). What does this mean for this vulnerability?
The attacker would have to be present on the system with root privileges to be able to exploit this vulnerability.
According to the CVSS metric, privileges required is high (PR:H). What privileges are required to exploit this vulnerability?
The attacker needs to have root privileges on the target system to be able to exploit this vulnerability.
Security updates
22.07 — https://azure.microsoft.com/en-us/updates/general-availability-azure-sphere-version-2207/
Vulnerabilities 1
-
Medium 4.4
Azure Sphere Information Disclosure Vulnerability
Azure Sphere Information Disclosure Vulnerability
Revision history
-
#1
Information published.
References
-
CVE-2022-35821 Azure Sphere Information Disclosure Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35821
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss