Lucene search

DellCVE-2022-34401

HistoryJan 18, 2023 - 6:15 a.m.

CVE-2022-34401

2023-01-1806:15:11

CWE-787

CWE-121

dell

web.nvd.nist.gov

cve-2022-34401

dell

bios

buffer overflow

vulnerability

smi

arbitrary code execution

smram

CVSS3

7.5

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS

Percentile

15.7%

JSON

Dell BIOS contains a stack based buffer overflow vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to send larger than expected input to a parameter in order to gain arbitrary code execution in SMRAM.

Affected configurations

Nvd

Vulners

Node

dellalienware_m15_a6_firmwareRange<1.4.3

AND

dellalienware_m15_a6Match-

Node

dellalienware_m17_r5_firmwareRange<1.4.3

AND

dellalienware_m17_r5Match-

Node

dellg15_5525_firmwareRange<1.4.3

AND

dellg15_5525Match-

VendorProductVersionCPE
dellalienware_m15_a6_firmware*cpe:2.3:o:dell:alienware_m15_a6_firmware:*:*:*:*:*:*:*:*
dellalienware_m15_a6-cpe:2.3:h:dell:alienware_m15_a6:-:*:*:*:*:*:*:*
dellalienware_m17_r5_firmware*cpe:2.3:o:dell:alienware_m17_r5_firmware:*:*:*:*:*:*:*:*
dellalienware_m17_r5-cpe:2.3:h:dell:alienware_m17_r5:-:*:*:*:*:*:*:*
dellg15_5525_firmware*cpe:2.3:o:dell:g15_5525_firmware:*:*:*:*:*:*:*:*
dellg15_5525-cpe:2.3:h:dell:g15_5525:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
dell	alienware_m15_a6_firmware	*	cpe:2.3:o:dell:alienware_m15_a6_firmware::::::::
dell	alienware_m15_a6	-	cpe:2.3:h:dell:alienware_m15_a6:-:::::::*
dell	alienware_m17_r5_firmware	*	cpe:2.3:o:dell:alienware_m17_r5_firmware::::::::
dell	alienware_m17_r5	-	cpe:2.3:h:dell:alienware_m17_r5:-:::::::*
dell	g15_5525_firmware	*	cpe:2.3:o:dell:g15_5525_firmware::::::::
dell	g15_5525	-	cpe:2.3:h:dell:g15_5525:-:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "CPG BIOS",
    "vendor": "Dell",
    "versions": [
      {
        "status": "affected",
        "version": "1.4.3"
      }
    ]
  }
]

References

www.dell.com/support/kbdoc/000204679

CVSS3

7.5

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS

Percentile

15.7%

JSON

Related for CVE-2022-34401