{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "Discovered by Claudio Bozzato and Lilith of Cisco Talos. with \u003ca href=\"https://talosintelligence.com/vulnerability_reports/\"\u003eCisco Talos\u003c/a\u003e"
        ]
      }
    ],
    "aggregate_severity": {
      "namespace": "https://www.microsoft.com/en-us/msrc/security-update-severity-rating-system",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      },
      {
        "category": "general",
        "text": "Required. The vulnerability documented by this CVE requires customer action to resolve.",
        "title": "Customer Action"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2022-35821 Azure Sphere Information Disclosure Vulnerability - HTML",
        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35821"
      },
      {
        "category": "self",
        "summary": "CVE-2022-35821 Azure Sphere Information Disclosure Vulnerability - CSAF",
        "url": "https://msrc.microsoft.com/csaf/2022/msrc_cve-2022-35821.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Exploitability Index",
        "url": "https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "Azure Sphere Information Disclosure Vulnerability",
    "tracking": {
      "current_release_date": "2022-08-09T07:00:00.000Z",
      "generator": {
        "date": "2025-01-02T19:33:43.212Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2022-35821",
      "initial_release_date": "2022-08-09T07:00:00.000Z",
      "revision_history": [
        {
          "date": "2022-08-09T07:00:00.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c22.07",
            "product": {
              "name": "Azure Sphere \u003c22.07",
              "product_id": "1"
            }
          },
          {
            "category": "product_version",
            "name": "22.07",
            "product": {
              "name": "Azure Sphere 22.07",
              "product_id": "11796"
            }
          }
        ],
        "category": "product_name",
        "name": "Azure Sphere"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-35821",
      "notes": [
        {
          "category": "general",
          "text": "Microsoft",
          "title": "Assigning CNA"
        },
        {
          "category": "faq",
          "text": "All versions of Azure Sphere that are 22.07 and higher are protected from this vulnerability.\nIf your device is new or has not been connected to the internet for a while, connect the device to a secure, private local network with internet access and allow the device to automatically update itself. If the device is already online, verify that the operating system version 21.07 has been installed using the Azure Sphere CLI command:\nazsphere device show-os-version\nIf the device is connected to the internet and does not yet have the latest update, check the update status with the following Azure Sphere CLI command:\nazsphere device show-deployment-status\nAn IoT device that is running Azure Sphere and is connected to a network is automatically updated every day. This vulnerability has already been addressed so the devices are protected from this vulnerability. More information on Azure Sphere\u2019s CVE principles can be found on https://docs.microsoft.com/en-us/azure-sphere/deployment/azure-sphere-cves",
          "title": "What version of Azure Sphere has the update that protects from this vulnerability?"
        },
        {
          "category": "faq",
          "text": "This vulnerability could allow an attacker to disclose the contents of the memory location, but they cannot modify the contents or make the system unavailable.",
          "title": "According to the CVSS metrics, successful exploitation of this vulnerability could lead to major loss of confidentiality (C:H) but have no effect on integrity (I:N) or on availability (A:N). What does that mean for this vulnerability?"
        },
        {
          "category": "faq",
          "text": "The attacker would have to be present on the system with root privileges to be able to exploit this vulnerability.",
          "title": "According to the CVSS metric, the attack vector is local (AV:L). What does this mean for this vulnerability?"
        },
        {
          "category": "faq",
          "text": "The attacker needs to have root privileges on the target system to be able to exploit this vulnerability.",
          "title": "According to the CVSS metric, privileges required is high (PR:H). What privileges are required to exploit this vulnerability?"
        }
      ],
      "product_status": {
        "fixed": [
          "11796"
        ],
        "known_affected": [
          "1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2022-35821 Azure Sphere Information Disclosure Vulnerability - HTML",
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35821"
        },
        {
          "category": "self",
          "summary": "CVE-2022-35821 Azure Sphere Information Disclosure Vulnerability - CSAF",
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35821"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-08-09T07:00:00.000Z",
          "details": "22.07:Security Update:https://azure.microsoft.com/en-us/updates/general-availability-azure-sphere-version-2207/",
          "product_ids": [
            "1"
          ],
          "url": "https://azure.microsoft.com/en-us/updates/general-availability-azure-sphere-version-2207/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "environmentalsScore": 0.0,
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 4.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Information Disclosure"
        },
        {
          "category": "exploit_status",
          "details": "Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely"
        }
      ],
      "title": "Azure Sphere Information Disclosure Vulnerability"
    }
  ]
}