PT-2024-2089 · Dell · Dell Poweredge Server Bios+1

Codebreaker1337 · Published 2024-03-12 · Updated 2025-01-31 · CVE-2024-0173

Positive Technologies (AI Summary)

CVSS v3.1

3.8

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Dell PowerEdge Server BIOS versions (affected versions not specified) Dell Precision Rack BIOS versions (affected versions not specified)

Description The issue is related to an improper parameter initialization vulnerability in the BIOS software of Dell PowerEdge servers and Dell Precision Rack workstations. This vulnerability can be exploited by a local low-privileged attacker to potentially read the contents of non-SMM stack memory, allowing unauthorized access to protected information.

Recommendations For Dell PowerEdge Server BIOS, update to a version that fixes the improper parameter initialization vulnerability. For Dell Precision Rack BIOS, update to a version that fixes the improper parameter initialization vulnerability. As a temporary workaround, consider restricting access to sensitive information and limiting privileges to minimize the risk of exploitation.

Fix

Out of bounds Read

Access of Memory Location After End of Buffer

Weakness Enumeration

CWE-125

CWE-788

Related Identifiers

BDU:2024-01985

CVE-2024-0173

Affected Products

Dell Poweredge Server Bios

Dell Precision Rack Bios

References · 7

• https://dell.com/support/kbdoc/en-us/000222898/dsa-2024-034-security-update-for-dell-poweredge-server-bios-for-an-improper-parameter-initialization-vulnerability · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-0173 · Security Note
• https://osv.dev/vulnerability/CVE-2024-0173 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01985 · Security Note
• https://twitter.com/RedPacketSec/status/1770028596192567478 · Twitter Post
• https://t.me/cvenotify/109452 · Telegram Post
• https://twitter.com/CVEnew/status/1767962571548569978 · Twitter Post