Main Vulnerability Database Vulnerabilities #VU79401

#VU79401 Buffer overflow in PowerEdge Server BIOS and Precision BIOS - CVE-2022-34406

Published: August 11, 2023

Vulnerability identifier: #VU79401

Vulnerability risk: Low

CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2022-34406

CWE-ID: CWE-119

Exploitation vector: Local access

Exploit availability: No public exploit available

Vulnerable software:
PowerEdge Server BIOS
Precision BIOS

Software vendor:
Dell

Description

The vulnerability allows a local privileged user to execute arbitrary code on the target system.

The vulnerability exists due to Improper SMM communication buffer verification. A local privileged user can send a specially crafted data, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Remediation

Install updates from vendor's website.

External links

https://www.dell.com/support/kbdoc/en-us/000206296/dsa-2022-204-dell-poweredge-improper-smm-communication-buffer-verification-vulnerability