CVE-2024-45759
📋 TL;DR
Dell PowerProtect Data Domain has a local privilege escalation vulnerability where authenticated low-privileged users can execute unauthorized commands to overwrite system configuration. This could lead to denial of service or system compromise. Affects Dell PowerProtect Data Domain versions before specified security updates.
💻 Affected Systems
- Dell PowerProtect Data Domain
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via configuration overwrite leading to persistent backdoor, data loss, or permanent denial of service requiring system rebuild.
Likely Case
Local attacker gains elevated privileges, modifies system configuration causing service disruption or data integrity issues.
If Mitigated
Limited impact due to strict access controls and monitoring, with quick detection of unauthorized configuration changes.
🎯 Exploit Status
Requires local authenticated access. No public exploit code available at time of analysis. CWE-266 indicates incorrect privilege assignment issue.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.1.0.0, 7.13.1.10, 7.10.1.40, or 7.7.5.50 depending on current version
Restart Required: Yes
Instructions:
1. Download appropriate patch from Dell Support. 2. Apply patch following Dell PowerProtect Data Domain update procedures. 3. Reboot system as required. 4. Verify patch installation and system functionality.
🔧 Temporary Workarounds
Restrict Local Access
linuxLimit local shell access to only necessary administrative users
# Review and restrict user accounts with shell access
# Use 'useradmin' or similar commands to modify user privileges
Enhanced Monitoring
allMonitor for unauthorized configuration changes and privilege escalation attempts
# Configure audit logging for configuration changes
# Monitor system logs for suspicious activity
🧯 If You Can't Patch
- Implement strict access controls - only grant local access to trusted administrators
- Enable comprehensive logging and monitoring for configuration changes and privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check current version using 'version' command in DD OS CLI and compare against patched versionsCheck Version:
versionVerify Fix Applied:
Verify version is 8.1.0.0, 7.13.1.10, 7.10.1.40, or 7.7.5.50 or later using 'version' command📡 Detection & Monitoring
Log Indicators:
- Unauthorized configuration file modifications
- Privilege escalation attempts
- Unexpected command execution by low-privileged users
Network Indicators:
- N/A - Local vulnerability
SIEM Query:
source="dd_system_logs" AND (event_type="config_change" OR event_type="privilege_escalation") AND user_privilege="low"