Lucene search

[email protected]CVE-2022-34401

HistoryJan 18, 2023 - 6:15 a.m.

CVE-2022-34401

2023-01-1806:15:11

CWE-787

CWE-121

[email protected]

web.nvd.nist.gov

cve-2022-34401

dell

bios

buffer overflow

vulnerability

smi

arbitrary code execution

smram

7.5 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

0.0004 Low

EPSS

Percentile

15.9%

JSON

Dell BIOS contains a stack based buffer overflow vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to send larger than expected input to a parameter in order to gain arbitrary code execution in SMRAM.

Affected configurations

NVD

Node

dellalienware_m15_a6_firmwareRange<1.4.3

AND

dellalienware_m15_a6Match-

Node

dellalienware_m17_r5_firmwareRange<1.4.3

AND

dellalienware_m17_r5Match-

Node

dellg15_5525_firmwareRange<1.4.3

AND

dellg15_5525Match-

CPENameOperatorVersion
dell:alienware_m15_a6_firmwaredell alienware m15 a6 firmwarelt1.4.3

CPE	Name	Operator	Version
dell:alienware_m15_a6_firmware	dell alienware m15 a6 firmware	lt	1.4.3

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "CPG BIOS",
    "vendor": "Dell",
    "versions": [
      {
        "status": "affected",
        "version": "1.4.3"
      }
    ]
  }
]