Support Product Security

SanDisk Professional G-RAID 4/8 Software Utility setup for Windows, Privilege Escalation

WDC Tracking Number: WDC-22007
Published: March 29, 2022

Last Updated: March 29, 2022

Description

The G-RAID 4/8 Software Utility setups for Windows were affected by a DLL hijacking vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the system user. Western Digital recommends all users install the latest updates for the Windows app and driver from the links below.

Product Impact
Minimum Fix Version
Last Updated
G-RAID 4/8 Software Utility Windows App
300520006-2
March 23, 2022
G-RAID 4/8 Software Utility Windows Driver
6.2.0.16-2
March 23, 2022

Advisory Summary

Resolved the DLL hijacking vulnerability in the G-RAID 4/8 Software Utility Windows app and driver which could allow malicious users to carry out escalation of privileges.

CVE Number: CVE-2022-22996

Reported By: DoHyun Lee(@l33d0hyun) and SeungYun LEE(@SeungYun_Le2) of Korea University Sejong Campus and JaeHeng Yoon(@onnoveath) of JENBlack Soft

Compare