Time-of-check Time-of-use (TOCTOU) Race Condition in Siemens products - CVE-2022-24351

Vulnerability identifier: #VU80878

CSH Severity: Low

CVSS v4: 5.9 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-24351

CWE-ID: CWE-367

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to compromise the target system.

The vulnerability exists due to a time-of-check, time-of-use (TOCTOU) race condition. A local attacker can alter data and code used by the remainder of the boot process.

RUGGEDCOM APE1808CLA-P CC
RUGGEDCOM APE1808W10 CC
RUGGEDCOM APE1808W10
RUGGEDCOM APE1808LNX CC
RUGGEDCOM APE1808LNX
RUGGEDCOM APE1808CLA-S5 CC
RUGGEDCOM APE1808CLA-S5
RUGGEDCOM APE1808CLA-S3 CC
RUGGEDCOM APE1808CLA-S3
RUGGEDCOM APE1808CLA-S1 CC
RUGGEDCOM APE1808CLA-S1
RUGGEDCOM APE1808 ADM
RUGGEDCOM APE1808CLA-P
RUGGEDCOM APE1808 SAM-L CC
RUGGEDCOM APE1808 SAM-L
RUGGEDCOM APE1808 ELAN CC
RUGGEDCOM APE1808 ELAN
RUGGEDCOM APE1808 CLOUDCONNECT CC
RUGGEDCOM APE1808 CLOUDCONNECT
RUGGEDCOM APE1808 CKP CC
RUGGEDCOM APE1808 CKP
RUGGEDCOM APE1808 ADM CC
Vostro 15 3535
Vostro 14 3435
Inspiron 15 3535
Vostro 16 5635
Inspiron 16 7635 2-in-1
Inspiron 16 5635
Inspiron 14 5435
Inspiron 14 7435 2-in-1
Dell G15 5525
Alienware m15 R7 AMD
Alienware m17 R5 AMD
Inspiron 14 7425 2-in-1
Vostro 5625
Inspiron 5425
Inspiron 15 3525
Vostro 3525
Vostro 3425
Inspiron 5405
Inspiron 5505
Dell G15 5515
Inspiron 7405 2-in-1
Inspiron 5415
Alienware m15 Ryzen Edition R5
Inspiron 3585
Inspiron 3785
Inspiron 3515
Vostro 3405
Inspiron 3505
Vostro 3515
Dell G5 5505
Inspiron 7415 2-in-1
Inspiron 5515
Vostro 5415
Vostro 5515

Install updates from vendor's website.

RUGGEDCOM APE1808CLA-P CC - update to 1.0.212N
RUGGEDCOM APE1808W10 CC - update to 1.0.212N
RUGGEDCOM APE1808W10 - update to 1.0.212N
RUGGEDCOM APE1808LNX CC - update to 1.0.212N
RUGGEDCOM APE1808LNX - update to 1.0.212N
RUGGEDCOM APE1808CLA-S5 CC - update to 1.0.212N
RUGGEDCOM APE1808CLA-S5 - update to 1.0.212N
RUGGEDCOM APE1808CLA-S3 CC - update to 1.0.212N
RUGGEDCOM APE1808CLA-S3 - update to 1.0.212N
RUGGEDCOM APE1808CLA-S1 CC - update to 1.0.212N
RUGGEDCOM APE1808CLA-S1 - update to 1.0.212N
RUGGEDCOM APE1808 ADM - update to 1.0.212N
RUGGEDCOM APE1808CLA-P - update to 1.0.212N
RUGGEDCOM APE1808 SAM-L CC - update to 1.0.212N
RUGGEDCOM APE1808 SAM-L - update to 1.0.212N
RUGGEDCOM APE1808 ELAN CC - update to 1.0.212N
RUGGEDCOM APE1808 ELAN - update to 1.0.212N
RUGGEDCOM APE1808 CLOUDCONNECT CC - update to 1.0.212N
RUGGEDCOM APE1808 CLOUDCONNECT - update to 1.0.212N
RUGGEDCOM APE1808 CKP CC - update to 1.0.212N
RUGGEDCOM APE1808 CKP - update to 1.0.212N
RUGGEDCOM APE1808 ADM CC - update to 1.0.212N
Vostro 15 3535 - update to 1.6.0
Vostro 14 3435 - update to 1.6.0
Inspiron 15 3535 - update to 1.6.0
Vostro 16 5635 - update to 1.6.1
Inspiron 16 7635 2-in-1 - update to 1.6.1
Inspiron 16 5635 - update to 1.6.1
Inspiron 14 5435 - update to 1.6.1
Inspiron 14 7435 2-in-1 - update to 1.6.1
Dell G15 5525 - update to 1.11.1
Alienware m15 R7 AMD - update to 1.11.1
Alienware m17 R5 AMD - update to 1.11.1
Inspiron 14 7425 2-in-1 - update to 1.12.1
Vostro 5625 - update to 1.12.1
Inspiron 5425 - update to 1.12.1
Inspiron 15 3525 - update to 1.13.0
Vostro 3525 - update to 1.13.0
Vostro 3425 - update to 1.13.0
Inspiron 5405 - update to 1.13.2
Inspiron 5505 - update to 1.13.2
Dell G15 5515 - update to 1.14.0
Inspiron 7405 2-in-1 - update to 1.14.2
Inspiron 5415 - update to 1.15.0
Alienware m15 Ryzen Edition R5 - update to 1.15.0
Inspiron 3585 - update to 1.15.0
Inspiron 3785 - update to 1.15.0
Inspiron 3515 - update to 1.15.1
Vostro 3405 - update to 1.15.1
Inspiron 3505 - update to 1.15.1
Vostro 3515 - update to 1.15.1
Dell G5 5505 - update to 1.17.2
Inspiron 7415 2-in-1 - update to 1.18.1
Inspiron 5515 - update to 1.18.1
Vostro 5415 - update to 1.18.1
Vostro 5515 - update to 1.18.1

• https://cert-portal.siemens.com/productcert/txt/ssa-957369.txt

• Multiple vulnerabilities in Siemens RUGGEDCOM APE1808 Product Family
• Dell Client Platform update for INSYDE UEFI BIOS