CVE-2020-5343 : Security Advisory and Response

Dell Client platforms restored using a Dell OS recovery image downloaded before December 20, 2019, may contain an insecure inherited permissions vulnerability that could be exploited by a local authenticated malicious user.

Understanding CVE-2020-5343

This CVE involves an insecure inherited permissions vulnerability on Dell Client platforms restored using a specific OS recovery image.

What is CVE-2020-5343?

CVE-2020-5343 refers to a security vulnerability found in Dell Client platforms that were restored using a Dell OS recovery image downloaded before December 20, 2019. This vulnerability allows a local authenticated malicious user with low privileges to gain unauthorized access to the root folder.

The Impact of CVE-2020-5343

The impact of this vulnerability is rated as high, with a CVSS base score of 7.3. The confidentiality, integrity, and availability of affected systems are all at risk, with the potential for unauthorized access by low-privileged users.

Technical Details of CVE-2020-5343

This section provides more technical insights into the vulnerability.

Vulnerability Description

The vulnerability involves insecure inherited permissions on Dell Client platforms restored using a specific OS recovery image.

Affected Systems and Versions

Product: CPG SW
Vendor: Dell
Versions Affected: Dell Client platforms restored using a Dell OS recovery image downloaded before December 20, 2019

Exploitation Mechanism

Attack Complexity: Low
Attack Vector: Local
Privileges Required: Low
User Interaction: Required
Scope: Unchanged
Availability Impact: High
Confidentiality Impact: High
Integrity Impact: High

Mitigation and Prevention

It is crucial to take immediate steps to mitigate the risks posed by CVE-2020-5343.

Immediate Steps to Take

Update the Dell OS recovery image to a version downloaded after December 20, 2019.
Monitor and restrict access to the root folder on affected systems.

Long-Term Security Practices

Regularly review and update permissions settings on Dell Client platforms.
Conduct security training for users to prevent unauthorized access.

Patching and Updates

Dell may release patches or updates to address this vulnerability. Stay informed about security advisories from Dell.