Summary

• Multiple vulnerabilities in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an attacker to escape from the guest virtual machine (VM) to the host machine, inject commands that execute at the root level, or leak system data from the host to the VM.

  For more information about these vulnerabilities, see the Details section of this advisory.

  Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.

  This advisory is available at the following link:
  https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-NFVIS-MUL-7DySRX9

Affected Products

• Vulnerable Products

  These vulnerabilities affect Cisco Enterprise NFVIS in the default configuration.

  For information about which Cisco software releases are vulnerable, see the Fixed Software section of this advisory.

  Products Confirmed Not Vulnerable

  Only products listed in the Vulnerable Products section of this advisory are known to be affected by these vulnerabilities.

Details

• The vulnerabilities are not dependent on one another. Exploitation of one of the vulnerabilities is not required to exploit another vulnerability. In addition, a software release that is affected by one of the vulnerabilities may not be affected by the other vulnerabilities.

  Details about the vulnerabilities are as follows:

  Cisco Enterprise NFVIS Guest Escape Vulnerability

  A vulnerability in the Next Generation Input/Output (NGIO) feature of Cisco Enterprise NFVIS could allow an authenticated, remote attacker to escape from the guest VM to gain unauthorized root-level access on the NFVIS host.

  This vulnerability is due to insufficient guest restrictions. An attacker could exploit this vulnerability by sending an API call from a VM that will execute with root-level privileges on the NFVIS host. A successful exploit could allow the attacker compromise the NFVIS host completely.

  Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

  Bug ID(s):CSCvz73973
  CVE ID: CVE-2022-20777
  Security Impact Rating (SIR): Critical
  CVSS Base Score: 9.9
  CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

  Cisco Enterprise NFVIS Command Injection Vulnerability

  A vulnerability in the image registration process of Cisco Enterprise NFVIS could allow an unauthenticated, remote attacker to inject commands that execute at the root level on the NFVIS host during the image registration process.

  This vulnerability is due to improper input validation. An attacker could exploit this vulnerability by persuading an administrator on the host machine to install a VM image with crafted metadata that will execute commands with root-level privileges during the VM registration process. A successful exploit could allow the attacker to inject commands with root-level privileges into the NFVIS host.

  Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

  Bug ID(s):CSCvz73988
  CVE ID: CVE-2022-20779
  Security Impact Rating (SIR): High
  CVSS Base Score: 8.8
  CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

  Cisco Enterprise NFVIS XML External Entity Injection Vulnerability

  A vulnerability in the import function of Cisco Enterprise NFVIS could allow an unauthenticated, remote attacker to leak system data from the host to any configured VM.

  This vulnerability is due to the resolution of external entities in the XML parser. An attacker could exploit this vulnerability by persuading an administrator to import a crafted file that will read data from the host and write it to any configured VM. A successful exploit could allow the attacker to access system information from the host, such as files containing user data, on any configured VM.

  Note: An attacker who already has authenticated access on a VM that is configured within the NFVIS host could obtain direct access to the confidential system information.

  Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

  Bug ID(s):CSCvz73971
  CVE ID: CVE-2022-20780
  Security Impact Rating (SIR): High
  CVSS Base Score: 7.4
  CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Workarounds

• There are no workarounds that address these vulnerabilities.

Fixed Software

• Cisco has released free software updates that address the vulnerabilities described in this advisory. Customers with service contracts that entitle them to regular software updates should obtain security fixes through their usual update channels.

  Customers may only install and expect support for software versions and feature sets for which they have purchased a license. By installing, downloading, accessing, or otherwise using such software upgrades, customers agree to follow the terms of the Cisco software license:
  https://www.cisco.com/c/en/us/products/end-user-license-agreement.html

  Additionally, customers may only download software for which they have a valid license, procured from Cisco directly, or through a Cisco authorized reseller or partner. In most cases this will be a maintenance upgrade to software that was previously purchased. Free security software updates do not entitle customers to a new software license, additional software feature sets, or major revision upgrades.

  The Cisco Support and Downloads page on Cisco.com provides information about licensing and downloads. This page can also display customer device support coverage for customers who use the My Devices tool.

  When considering software upgrades, customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page, to determine exposure and a complete upgrade solution.

  In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.

  Customers Without Service Contracts

  Customers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco TAC: https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html

  Customers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade.

  Fixed Releases

  Customers are advised to upgrade to an appropriate fixed software release as indicated in the following table(s):

  Cisco Enterprise NFVIS Release	First Fixed Release
  Earlier than 4.0	Migrate to a fixed release.
  4.0	4.7.1

  The Cisco Product Security Incident Response Team (PSIRT) validates only the affected and fixed release information that is documented in this advisory.

Exploitation and Public Announcements

• The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.

Source

• Cisco would like to thank Cyrille Chatras, Pierre Denouel, and Loïc Restoux of Orange Group for reporting these vulnerabilities.

URL

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-NFVIS-MUL-7DySRX9

Revision History

• Version	Description	Section	Status	Date
  1.0	Initial public release.	-	Final	2022-MAY-04

  Show Less