CVE-2022-38392

Certain 5400 RPM hard drives, for laptops and other PCs in approximately 2005 and later, allow physically proximate attackers to cause a denial of service (device malfunction and system crash) via a resonant-frequency attack with the audio signal from the Rhythm Nation music video. A reported product is Seagate STDT4000100 763649053447.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.9 / Impact : 4.0

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://devblogs.microsoft.com/oldnewthing/20220816-00/?p=106994	Issue Tracking Third Party Advisory
https://www.seagate.com/support/security/
https://www.youtube.com/watch?v=nSvu9IDUjZw&t=416s
https://devblogs.microsoft.com/oldnewthing/20220816-00/?p=106994	Issue Tracking Third Party Advisory
https://www.seagate.com/support/security/
https://www.youtube.com/watch?v=nSvu9IDUjZw&t=416s

Configurations

Configuration 1 (hide)

cpe:2.3:h:*:5400rmp_oem_harddrive:-:*:*:*:*:*:*:*

History

21 Nov 2024, 07:16

Type	Values Removed	Values Added
References	~~() https://devblogs.microsoft.com/oldnewthing/20220816-00/?p=106994 - Issue Tracking, Third Party Advisory~~	() https://devblogs.microsoft.com/oldnewthing/20220816-00/?p=106994 - Issue Tracking, Third Party Advisory
References	~~() https://www.seagate.com/support/security/ -~~	() https://www.seagate.com/support/security/ -
References	~~() https://www.youtube.com/watch?v=nSvu9IDUjZw&t=416s -~~	() https://www.youtube.com/watch?v=nSvu9IDUjZw&t=416s -

30 Aug 2022, 06:15

Type	Values Removed	Values Added
References		(MISC) https://www.youtube.com/watch?v=nSvu9IDUjZw&t=416s -
Summary	A certain 5400 RPM OEM hard drive, as shipped with laptop PCs in approximately 2005, allows physically proximate attackers to cause a denial of service (device malfunction and system crash) via a resonant-frequency attack with the audio signal from the Rhythm Nation music video.	Certain 5400 RPM hard drives, for laptops and other PCs in approximately 2005 and later, allow physically proximate attackers to cause a denial of service (device malfunction and system crash) via a resonant-frequency attack with the audio signal from the Rhythm Nation music video. A reported product is Seagate STDT4000100 763649053447.

20 Aug 2022, 01:27

Type	Values Removed	Values Added
CPE		cpe:2.3:h::5400rmp_oem_harddrive:-:::::::
References	~~(MISC) https://devblogs.microsoft.com/oldnewthing/20220816-00/?p=106994 -~~	(MISC) https://devblogs.microsoft.com/oldnewthing/20220816-00/?p=106994 - Issue Tracking, Third Party Advisory
CWE		NVD-CWE-noinfo
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.3

17 Aug 2022, 18:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-08-17 18:15

Updated : 2024-11-21 07:16

NVD link : CVE-2022-38392

Mitre link : CVE-2022-38392

CVE.ORG link : CVE-2022-38392

JSON object : View

Products Affected

5400rmp_oem_harddrive

CWE

NVD-CWE-noinfo

{"id": "CVE-2022-38392", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 0.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 0.9}]}, "published": "2022-08-17T18:15:08.297", "references": [{"url": "https://devblogs.microsoft.com/oldnewthing/20220816-00/?p=106994", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.seagate.com/support/security/", "source": "cve@mitre.org"}, {"url": "https://www.youtube.com/watch?v=nSvu9IDUjZw&t=416s", "source": "cve@mitre.org"}, {"url": "https://devblogs.microsoft.com/oldnewthing/20220816-00/?p=106994", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.seagate.com/support/security/", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.youtube.com/watch?v=nSvu9IDUjZw&t=416s", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Certain 5400 RPM hard drives, for laptops and other PCs in approximately 2005 and later, allow physically proximate attackers to cause a denial of service (device malfunction and system crash) via a resonant-frequency attack with the audio signal from the Rhythm Nation music video. A reported product is Seagate STDT4000100 763649053447."}, {"lang": "es", "value": "Ciertos discos duros de 5400 RPM, para ordenadores port\u00e1tiles y otros PC de aproximadamente 2005 y posteriores, permiten a los atacantes f\u00edsicamente pr\u00f3ximos provocar una denegaci\u00f3n de servicio (mal funcionamiento del dispositivo y ca\u00edda del sistema) mediante un ataque de frecuencia resonante con la se\u00f1al de audio del v\u00eddeo musical Rhythm Nation. Un producto reportado es Seagate STDT4000100 763649053447"}], "lastModified": "2024-11-21T07:16:23.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:*:5400rmp_oem_harddrive:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F5517E28-B2E8-41A9-A3F2-425A650E38BF"}], "operator": "OR"}]}], "evaluatorComment": "Due to the lack of publicly available information regarding any specific targeted products for this vulnerability, we are unable to provide a legitimate CPE value for this CVE's configuration. ", "sourceIdentifier": "cve@mitre.org"}

5.3 /10