SecBoard
Zurück zur CVE-Übersicht

CVE-2025-36462

HIGH(7.3)

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Risk Signal Score18/100 — NIEDRIG
  • CVSS 7.3 — Hoch

EPSS-Score

0.1%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

7.3

Technische Schwere

Beschreibung

Multiple out-of-bounds read and write vulnerabilities exist in the ControlVault WBDI Driver Broadcom Storage Adapter functionality of Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus prior to 6.2.36.47. A specially crafted WinBioControlUnit call can lead to memory corruption. An attacker can issue an api call to trigger this vulnerability. This vulnerability is triggered when submitting a `WinBioControlUnit` call to the StorageAdapter with the ControlCode 3 (`WBIO_USH_CREATE_CHALLENGE`) with an invalid `ReceiveBuferSize`.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • 5.15.14.19
  • 6.2.36.47

Threat-Hunting-Queries

Detection for WinBioControlUnit calls with invalid ReceiveBufferSize to the StorageAdapter with ControlCode 3 (WBIO_USH_CREATE_CHALLENGE). This requires monitoring of Windows Biometric Framework API calls, which might not be directly available in standard logs and may require custom instrumentation or kernel-level monitoring.

Sentinel/Defender KQL

DeviceProcessEvents
| where ProcessCommandLine contains "WinBioControlUnit" and ProcessCommandLine contains "ControlCode 3" and ProcessCommandLine contains "ReceiveBufferSize"

Splunk SPL

index=* (WinBioControlUnit AND "ControlCode 3" AND ReceiveBufferSize)

Sigma

title: Dell ControlVault3 WBDI Driver OOB Write
status: experimental
description: Detects suspicious WinBioControlUnit calls to the StorageAdapter with ControlCode 3 (WBIO_USH_CREATE_CHALLENGE) and an invalid ReceiveBufferSize.
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains_all:
      - 'WinBioControlUnit'
      - 'ControlCode 3'
      - 'ReceiveBufferSize'
  condition: selection

Elastic ES|QL

from process where process.command_line : "WinBioControlUnit" and process.command_line : "ControlCode 3" and process.command_line : "ReceiveBufferSize"

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Indikatoren

Domains (3)

  • dell.com
  • broadcom.com
  • talosintelligence.com

Übernommen wurden nur Indikatoren, die wörtlich in einer Hersteller- oder Research-Quelle standen.

Referenzen