PT-2021-14604 · Dell · Dell Poweredge R840+5

Alexander Matrosov + 1 · Published 2021-06-14 · Updated 2021-06-23 · CVE-2021-21556

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Dell PowerEdge R640, R740, R740XD, R840, R940, R940xa, MX740c, MX840c, and T640 Server BIOS (affected versions not specified)

Description A stack-based buffer overflow vulnerability exists in systems with NVDIMM-N installed, which can be exploited by a local malicious user with high privileges. This could lead to a denial of Service, arbitrary code execution, or information disclosure in UEFI or BIOS Preboot Environment.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787

CWE-121

Related Identifiers

CVE-2021-21556

Affected Products

Dell Poweredge Mx740C

Dell Poweredge Mx840C

Dell Poweredge R640

Dell Poweredge R740

Dell Poweredge R840

Dell Poweredge R940

References · 5

• https://osv.dev/vulnerability/CVE-2021-21556 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21556 · Security Note
• https://dell.com/support/kbdoc/000187958 · Vendor Advisory
• https://t.me/cibsecurity/25444 · Telegram Post
• https://t.me/cvenotify/16301 · Telegram Post