CVE-2022-38392 - OpenCVE

Certain 5400 RPM hard drives, for laptops and other PCs in approximately 2005 and later, allow physically proximate attackers to cause a denial of service (device malfunction and system crash) via a resonant-frequency attack with the audio signal from the Rhythm Nation music video. A reported product is Seagate STDT4000100 763649053447.

Attack Vector Physical

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
*	5400rmp Oem Harddrive

Configuration 1 [-]

cpe:2.3:h:*:5400rmp_oem_harddrive:-:*:*:*:*:*:*:*

References

Link	Resource
https://devblogs.microsoft.com/oldnewthing/20220816-00/?p=106994	Issue Tracking Third Party Advisory
https://www.seagate.com/support/security/
https://www.youtube.com/watch?v=nSvu9IDUjZw&t=416s

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: mitre

Published: 2022-08-17T00:00:00

Updated: 2023-09-09T20:10:10.039185

Reserved: 2022-08-17T00:00:00

Link: CVE-2022-38392

JSON object: View

NVD Information

Status : Modified

Published: 2022-08-17T18:15:08.297

Modified: 2023-09-09T21:15:43.120

Link: CVE-2022-38392

JSON object: View

Redhat Information

No data.

CWE

NVD-CWE-noinfo

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:h:*:5400rmp_oem_harddrive:-:*:*:*:*:*:*:*", "matchCriteriaId": "F5517E28-B2E8-41A9-A3F2-425A650E38BF", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Certain 5400 RPM hard drives, for laptops and other PCs in approximately 2005 and later, allow physically proximate attackers to cause a denial of service (device malfunction and system crash) via a resonant-frequency attack with the audio signal from the Rhythm Nation music video. A reported product is Seagate STDT4000100 763649053447."}, {"lang": "es", "value": "Ciertos discos duros de 5400 RPM, para ordenadores port\u00e1tiles y otros PC de aproximadamente 2005 y posteriores, permiten a los atacantes f\u00edsicamente pr\u00f3ximos provocar una denegaci\u00f3n de servicio (mal funcionamiento del dispositivo y ca\u00edda del sistema) mediante un ataque de frecuencia resonante con la se\u00f1al de audio del v\u00eddeo musical Rhythm Nation. Un producto reportado es Seagate STDT4000100 763649053447"}], "evaluatorComment": "Due to the lack of publicly available information regarding any specific targeted products for this vulnerability, we are unable to provide a legitimate CPE value for this CVE's configuration. ", "id": "CVE-2022-38392", "lastModified": "2023-09-09T21:15:43.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 4.0, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 4.0, "source": "cve@mitre.org", "type": "Secondary"}]}, "published": "2022-08-17T18:15:08.297", "references": [{"source": "cve@mitre.org", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://devblogs.microsoft.com/oldnewthing/20220816-00/?p=106994"}, {"source": "cve@mitre.org", "url": "https://www.seagate.com/support/security/"}, {"source": "cve@mitre.org", "url": "https://www.youtube.com/watch?v=nSvu9IDUjZw&t=416s"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}