Buffer overflow in Dell products - CVE-2023-32461

Vulnerability identifier: #VU80863

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-32461

CWE-ID: CWE-119

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error in Dell PowerEdge BIOS and Dell Precision BIOS firmware. local user can trigger memory corruption and execute arbitrary code with elevated privileges.

PowerEdge XR8620t
PowerEdge XE9680
PowerEdge R760xa
PowerEdge XR5610
PowerEdge XE8640
PowerEdge R7625
PowerEdge R6625
PowerEdge R7615
PowerEdge R6615
PowerEdge R760
PowerEdge R660
PowerEdge XR7620
PowerEdge R760xd2
PowerEdge C6620
PowerEdge MX760c
PowerEdge R860
PowerEdge R960
PowerEdge HS5610
PowerEdge HS5620
PowerEdge R660xs
PowerEdge R760xs
PowerEdge T560
PowerEdge R350
PowerEdge R250
PowerEdge T350
PowerEdge T150
PowerEdge MX750c
PowerEdge XR12
PowerEdge XR11
PowerEdge T550
PowerEdge R650XS
PowerEdge R450
PowerEdge R550
PowerEdge C6520
PowerEdge R750XA
PowerEdge R750
PowerEdge R650
PowerEdge R750XS
PowerEdge XR4510c
PowerEdge XR4520c
Dell EMC XC Core XC6520
Dell EMC XC Core XC750xa
Dell EMC XC Core XC750
Dell EMC XC Core XC650
Dell EMC XC Core XC450
Dell EMC XC Core XC7525
Precision 7960 XL Rack
PowerEdge XE8545
PowerEdge C6525
PowerEdge R7525
PowerEdge R6525
PowerEdge R7515
PowerEdge R6515
Precision 7960 Rack

Install updates from vendor's website.

PowerEdge XR8620t - update to 1.1.3
PowerEdge XE9680 - update to 1.1.3
PowerEdge R760xa - update to 1.1.3
PowerEdge XR5610 - update to 1.1.4
PowerEdge XE8640 - update to 1.2.5
PowerEdge R7625 - update to 1.3.11
PowerEdge R6625 - update to 1.3.11
PowerEdge R7615 - update to 1.3.11
PowerEdge R6615 - update to 1.3.11
PowerEdge R760 - update to 1.5.6
PowerEdge R660 - update to 1.5.6
PowerEdge XR7620 - update to 1.5.6
PowerEdge R760xd2 - update to 1.5.6
PowerEdge C6620 - update to 1.5.6
PowerEdge MX760c - update to 1.5.6
PowerEdge R860 - update to 1.5.6
PowerEdge R960 - update to 1.5.6
PowerEdge HS5610 - update to 1.5.6
PowerEdge HS5620 - update to 1.5.6
PowerEdge R660xs - update to 1.5.6
PowerEdge R760xs - update to 1.5.6
PowerEdge T560 - update to 1.5.6
PowerEdge R350 - update to 1.6.3
PowerEdge R250 - update to 1.6.3
PowerEdge T350 - update to 1.6.3
PowerEdge T150 - update to 1.6.3
PowerEdge MX750c - update to 1.10.2
PowerEdge XR12 - update to 1.10.2
PowerEdge XR11 - update to 1.10.2
PowerEdge T550 - update to 1.10.2
PowerEdge R650XS - update to 1.10.2
PowerEdge R450 - update to 1.10.2
PowerEdge R550 - update to 1.10.2
PowerEdge C6520 - update to 1.10.2
PowerEdge R750XA - update to 1.10.2
PowerEdge R750 - update to 1.10.2
PowerEdge R650 - update to 1.10.2
PowerEdge R750XS - update to 1.10.2
PowerEdge XR4510c - update to 1.10.4
PowerEdge XR4520c - update to 1.10.4
Dell EMC XC Core XC6520 - update to 1.11.2
Dell EMC XC Core XC750xa - update to 1.11.2
Dell EMC XC Core XC750 - update to 1.11.2
Dell EMC XC Core XC650 - update to 1.11.2
Dell EMC XC Core XC450 - update to 1.11.2
Dell EMC XC Core XC7525 - update to 2.11.3
PowerEdge XE8545 - update to 2.11.3
PowerEdge C6525 - update to 2.11.3
PowerEdge R7525 - update to 2.11.3
PowerEdge R6525 - update to 2.11.3
PowerEdge R7515 - update to 2.11.4
PowerEdge R6515 - update to 2.11.4
Precision 7960 Rack - update to 1.4.4
Precision 7960 XL Rack - update to 1.4.4

• https://www.dell.com/support/kbdoc/nl-nl/000216543/dsa-2023-292-security-update-for-dell-poweredge-server-bios-vulnerability

• Privilege escalation in Dell PowerEdge BIOS and Dell Precision BIOS
• Buffer overflow in Dell Precision Rack BIOS