Lucene search

[email protected]CVE-2022-34399

HistoryJan 18, 2023 - 12:15 p.m.

CVE-2022-34399

2023-01-1812:15:10

CWE-119

CWE-805

[email protected]

web.nvd.nist.gov

cve-2022-34399

dell

alienware

m17 r5

bios

vulnerability

buffer access vulnerability

admin privileges

smram

5.1 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N

4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.2%

JSON

Dell Alienware m17 R5 BIOS version prior to 1.2.2 contain a buffer access vulnerability. A malicious user with admin privileges could potentially exploit this vulnerability by sending input larger than expected in order to leak certain sections of SMRAM.

Affected configurations

NVD

Node

dellalienware_m15_a6_firmwareRange<1.4.3

AND

dellalienware_m15_a6Match-

Node

dellalienware_m15_ryzen_edition_r5_firmwareRange<1.8.0

AND

dellalienware_m15_ryzen_edition_r5Match-

Node

dellalienware_m17_ryzen_edition_r5_firmwareRange<1.4.3

AND

dellalienware_m17_ryzen_edition_r5Match-

Node

dellg15_5515_firmwareRange<1.8.0

AND

dellg15_5515Match-

Node

dellg15_5525_firmwareRange<1.4.3

AND

dellg15_5525Match-

Node

dellinspiron_3505_firmwareRange<1.9.0

AND

dellinspiron_3505Match-

Node

dellinspiron_3515_firmwareRange<1.9.0

AND

dellinspiron_3515Match-

Node

dellinspiron_3525_firmwareRange<1.5.0

AND

dellinspiron_3525Match-

Node

dellinspiron_3585_firmwareRange<1.10.0

AND

dellinspiron_3585Match-

Node

dellinspiron_3595_firmwareRange<1.5.0

AND

dellinspiron_3595Match-

Node

dellinspiron_3785_firmwareRange<1.10.0

AND

dellinspiron_3785Match-

Node

dellvostro_3405_firmwareRange<1.9.0

AND

dellvostro_3405Match-

Node

dellvostro_3425_firmwareRange<1.5.0

AND

dellvostro_3425Match-

Node

dellvostro_3515_firmwareRange<1.9.0

AND

dellvostro_3515Match-

Node

dellvostro_3525_firmwareRange<1.5.0

AND

dellvostro_3525Match-

CPENameOperatorVersion
dell:alienware_m15_a6_firmwaredell alienware m15 a6 firmwarelt1.4.3

CPE	Name	Operator	Version
dell:alienware_m15_a6_firmware	dell alienware m15 a6 firmware	lt	1.4.3

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "CPG BIOS",
    "vendor": "Dell",
    "versions": [
      {
        "lessThan": "1.2.2",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.dell.com/support/kbdoc/en-us/000205329/dsa-2022-317-dell-client-security-update-for-dell-client-bios

5.1 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N

4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.2%

JSON

Related for CVE-2022-34399

cnvd1 cvelist1 nvd1 prion1