CVE-2021-21589

Vulnerability

Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.1.0.0.5.394 do not exit on failed initialization. This flaw exists in the proprietary code of these storage platforms and allows a local authenticated Service user to potentially exploit the improper termination handling to escalate privileges [1].

Exploitation

An attacker must already have local authenticated access as a Service user with high privileges. The vulnerability is triggered when the system encounters a failed initialization; instead of exiting, the software continues execution in an insecure state. A local attacker with this access can then manipulate the inconsistent state to gain elevated privileges [1].

Impact

Successful exploitation enables the attacker to escalate privileges to a higher level, potentially gaining full control over the affected Unity system. The CVSS v3.1 base score is 5.7 (AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H), indicating a medium severity with high impact on integrity and availability, although confidentiality is not directly affected [1].

Mitigation

The vulnerability is fixed in Unity, Unity XT, and UnityVSA version 5.1.0.0.5.394 and later. Dell recommends all customers running an affected version to upgrade to this patched release immediately. No workarounds are detailed in the available references [1].