Lucene search

[email protected]CVE-2021-21556

HistoryJun 14, 2021 - 7:15 p.m.

CVE-2021-21556

2021-06-1419:15:08

CWE-121

CWE-787

[email protected]

web.nvd.nist.gov

cve-2021-21556

dell poweredge

bios

vulnerability

nvdimm-n

uefi

denial of service

arbitrary code execution

information disclosure

7.2 High

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

6.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

6.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

Dell PowerEdge R640, R740, R740XD, R840, R940, R940xa, MX740c, MX840c, and T640 Server BIOS contain a stack-based buffer overflow vulnerability in systems with NVDIMM-N installed. A local malicious user with high privileges may potentially exploit this vulnerability, leading to a denial of Service, arbitrary code execution, or information disclosure in UEFI or BIOS Preboot Environment.

Affected configurations

NVD

Node

dellpoweredge_r640_firmwareRange<2.11.2

AND

dellpoweredge_r640Match-

Node

dellpoweredge_r740_firmwareRange<2.11.2

AND

dellpoweredge_r740Match-

Node

dellpoweredge_r740xd_firmwareRange<2.11.2

AND

dellpoweredge_r740xdMatch-

Node

dellpoweredge_r940_firmwareRange<2.11.2

AND

dellpoweredge_r940Match-

Node

dellpoweredge_r840_firmwareRange<2.11.2

AND

dellpoweredge_r840Match-

Node

dellpoweredge_r940xa_firmwareRange<2.11.2

AND

dellpoweredge_r940xaMatch-

Node

dellpoweredge_t640_firmwareRange<2.11.2

AND

dellpoweredge_t640Match-

Node

dellpoweredge_mx740c_firmwareRange<2.11.2

AND

dellpoweredge_mx740cMatch-

Node

dellpoweredge_mx840c_firmwareRange<2.11.2

AND

dellpoweredge_mx840cMatch-

CPENameOperatorVersion
dell:poweredge_r640_firmwaredell poweredge r640 firmwarelt2.11.2

CPE	Name	Operator	Version
dell:poweredge_r640_firmware	dell poweredge r640 firmware	lt	2.11.2

CNA Affected

[
  {
    "product": "PowerEdge BIOS Intel 15G",
    "vendor": "Dell",
    "versions": [
      {
        "lessThan": "2.11.2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.dell.com/support/kbdoc/000187958

Social References

7.2 High

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

6.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

6.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

Related for CVE-2021-21556

cvelist1 prion1 nvd1