PT-2022-6364 · Dell · Dell Bios

Yngweijw · Published 2022-09-30 · Updated 2022-10-13 · CVE-2022-34390

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell BIOS (affected versions not specified)

Description The issue is related to the use of an uninitialized variable in the BIOS software of Dell laptops. This could potentially allow a malicious user to execute arbitrary code. A local authenticated attacker may exploit this vulnerability to gain arbitrary code execution in SMRAM by using an SMI.

Recommendations For Dell BIOS, consider restricting access to SMI handlers until a patch is available. As a temporary workaround, avoid using potentially vulnerable SMI handlers in Dell BIOS until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of Uninitialized Resource

Weakness Enumeration

CWE-908

CWE-457

Related Identifiers

BDU:2023-01052

CVE-2022-34390

Affected Products

Dell Bios

References · 5

• https://osv.dev/vulnerability/CVE-2022-34390 · Vendor Advisory
• https://dell.com/support/kbdoc/000203882 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-34390 · Security Note
• https://bdu.fstec.ru/vul/2023-01052 · Security Note
• https://dell.com/support/kbdoc/en-uk/000203882/dsa-2022-269-dell-client-platform-bios-security-update-for-alienware-area-51-r4-r5 · Note