Overview
CVE-2025-36461 describes multiple out-of-bounds read and write vulnerabilities found in the ControlVault WBDI Driver Broadcom Storage Adapter functionality of Dell ControlVault3. Specifically, affected versions include Dell ControlVault3 prior to 5.15.14.19 and Dell ControlVault3 Plus prior to 6.2.36.47. This high-severity vulnerability can lead to memory corruption, potentially allowing an attacker to gain unauthorized access or execute arbitrary code.
Technical Details
The vulnerability lies within the handling of WinBioControlUnit calls to the StorageAdapter. An attacker can trigger the out-of-bounds read and write conditions by crafting a specific API call with the ControlCode 0 (WBIO_USH_GET_TEMPLATE) and specific buffer sizes:
- Out-of-bounds Write: Occurs when
ReceiveBuferSizeis greater than 0 but less than 4 (0 < ReceiveBuferSize < 4). This leads to a write of up to 3 bytes beyond the allocated buffer. - Out-of-bounds Read: Occurs when
SendBufferSizeis greater than 0 but less than 76 (0 < SendBufferSize < 76). This triggers a read of up to 75 bytes beyond the allocated buffer.
The ability to control the size of the receive and send buffers allows an attacker to precisely target the memory regions they wish to corrupt or read from.
CVSS Analysis
The vulnerability has a CVSS score of 7.3, indicating a HIGH severity. While the specifics may vary based on environment, a CVSS score in this range signifies a significant risk. The exploit is likely complex but potentially allows for significant impact to system integrity and confidentiality.
Possible Impact
Successful exploitation of CVE-2025-36461 can lead to several critical consequences:
- Memory Corruption: The out-of-bounds write can corrupt critical data structures in memory, potentially causing system crashes or unpredictable behavior.
- Information Disclosure: The out-of-bounds read can allow an attacker to access sensitive information stored in adjacent memory regions, potentially including passwords, cryptographic keys, or other confidential data.
- Privilege Escalation: Depending on the targeted memory regions, an attacker might be able to escalate their privileges and gain control of the system.
- Remote Code Execution: In a fully realized exploit scenario, an attacker could leverage the memory corruption to inject and execute arbitrary code, effectively taking over the affected system.
Mitigation and Patch Steps
The primary mitigation strategy is to update Dell ControlVault3 to the latest versions that address this vulnerability. Dell has released updates to address this issue. Please apply the appropriate patch as soon as possible.
- Update ControlVault3: Upgrade to version 5.15.14.19 or later for Dell ControlVault3.
- Update ControlVault3 Plus: Upgrade to version 6.2.36.47 or later for Dell ControlVault3 Plus.
Refer to the Dell Security Advisory for detailed instructions on obtaining and applying the necessary updates.
