PT-2023-29196 · Intel+1 · Intel E5+2

Published 2023-12-05 · Updated 2023-12-12 · CVE-2023-44297

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Dell PowerEdge platforms 16G Intel E5 BIOS version 1.4.4 Dell Precision BIOS version 1.4.4

Description The issue concerns active debug code security vulnerability in the BIOS. An unauthenticated physical attacker could potentially exploit this, leading to information disclosure, information tampering, code execution, or denial of service.

Recommendations For Dell PowerEdge platforms 16G Intel E5 BIOS version 1.4.4, update the BIOS to a version that does not contain the active debug code. For Dell Precision BIOS version 1.4.4, update the BIOS to a version that does not contain the active debug code. As a temporary workaround, consider restricting physical access to the systems until a patch is available.

Fix

Improper Locking

Weakness Enumeration

CWE-1234

CWE-667

Related Identifiers

CVE-2023-44297

Affected Products

Dell Poweredge

Dell Precision

Intel E5

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-44297 · Security Note
• https://osv.dev/vulnerability/CVE-2023-44297 · Vendor Advisory
• https://dell.com/support/kbdoc/en-us/000220047/dsa-2023-429-security-update-for-dell-16g-poweredge-server-bios-for-a-debug-code-security-vulnerability · Vendor Advisory
• https://t.me/cvenotify/62397 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1732095493855932497 · Twitter Post
• https://twitter.com/CVEnew/status/1732072814994472971 · Twitter Post
• https://t.me/cvenotify/63255 · Telegram Post
• https://t.me/cvenotify/62337 · Telegram Post