PT-2024-2312 · Dell · Dell Poweredge Server Bios+1

Published 2024-03-12 · Updated 2024-03-13 · CVE-2024-0163

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Dell PowerEdge Server BIOS (affected versions not specified) Dell Precision Rack BIOS (affected versions not specified)

Description The issue is related to a Time-of-check Time-of-use (TOCTOU) Race Condition in the BIOS microcode of Dell PowerEdge servers and Dell Precision Rack workstations, which is associated with state management errors. Exploitation of this issue could allow an attacker to gain unauthorized access to protected information and compromise the system. A local low-privileged attacker could potentially exploit this issue to gain access to otherwise unauthorized resources.

Recommendations For Dell PowerEdge Server BIOS, at the moment, there is no information about a newer version that contains a fix for this issue. For Dell Precision Rack BIOS, at the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

BDU:2024-02246

CVE-2024-0163

Affected Products

Dell Poweredge Server Bios

Dell Precision Rack Bios

References · 5

• https://dell.com/support/kbdoc/en-us/000222756/dsa-2024-003-security-update-for-dell-poweredge-server-bios-for-a-time-of-check-time-of-use-toctou-vulnerability · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-0163 · Security Note
• https://bdu.fstec.ru/vul/2024-02246 · Security Note
• https://osv.dev/vulnerability/CVE-2024-0163 · Vendor Advisory
• https://twitter.com/CVEnew/status/1767962584337031608 · Twitter Post