PT-2024-2342 · Dell · Dell Poweredge Server Bios

Schur · Published 2024-03-18 · Updated 2024-03-21 · CVE-2024-22453

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell PowerEdge Server BIOS (affected versions not specified)

Description The issue is related to a heap-based buffer overflow vulnerability in the Dell PowerEdge Server BIOS. A local high privileged attacker could potentially exploit this vulnerability to write to otherwise unauthorized memory, affecting the integrity and availability of the system.

Recommendations Update BIOS to v1.19.0/2.14.0/2.19.0 as soon as possible to secure the servers.

Fix

Memory Corruption

Heap Based Buffer Overflow

Weakness Enumeration

CWE-787

CWE-122

Related Identifiers

BDU:2024-02290

CVE-2024-22453

Affected Products

Dell Poweredge Server Bios

References · 8

• https://osv.dev/vulnerability/CVE-2024-22453 · Vendor Advisory
• https://dell.com/support/kbdoc/en-us/000223209/dsa-2024-105-security-update-for-dell-poweredge-server-bios-for-a-heap-based-buffer-overflow-vulnerability · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02290 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-22453 · Security Note
• https://twitter.com/oktsec/status/1770171555798040619 · Twitter Post
• https://t.me/cvenotify/74230 · Telegram Post
• https://twitter.com/CVEnew/status/1769995350243267065 · Twitter Post
• https://twitter.com/RedPacketSec/status/1770753781619097800 · Twitter Post