CVE-2022-22474 Denial of service in Spectrum Protect Client
Attackers can cause denial of service for IBM Spectrum Protect client operations by exploiting improper TCP/IP socket handling.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-22474?
CVE-2022-22474 is a medium-severity denial of service vulnerability in IBM Spectrum Protect Client, published on 30 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
IBM Spectrum Protect 8.1.0.0 through 8.1.14.0 dsmcad, dsmc, and dsmcsvc processes incorrectly handle certain read operations on TCP/IP sockets. This can result in a denial of service for IBM Spectrum Protect client operations. IBM X-Force ID: 225348.
Which versions are affected by CVE-2022-22474?
It affects 1 product.
Products include Ibm Spectrum Protect Client.
How do I fix CVE-2022-22474?
No fix has been published for CVE-2022-22474 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-22474 being exploited?
There is no known exploitation of CVE-2022-22474 in the wild and no public exploit code.
Other vulnerabilities in IBM Spectrum Protect Client
- CVE-2021-29672 Memory corruption in Spectrum Protect for Space Management
- CVE-2020-4494 Auth bypass in Spectrum Protect Client (AIX)
- CVE-2023-33832 IBM Storage Protect denial of service
- CVE-2022-22478 Information disclosure in Spectrum Protect Client
- CVE-2021-20546 Memory corruption in Spectrum Protect for Space Management
Sources
Also known as GHSA-wm9g-cqmh-5gqv.