Dell Client BIOS Improper SMM Communication Buffer Verification (DSA-2024-104)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(266459);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/10/03");

  script_cve_id("CVE-2024-25942");
  script_xref(name:"IAVA", value:"2025-A-0713");

  script_name(english:"Dell Client BIOS Improper SMM Communication Buffer Verification (DSA-2024-104)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch");
  script_set_attribute(attribute:"description", value:
"The Dell BIOS on the remote device is missing a security patch and is, therefore, affected by an Improper SMM
communication buffer verification vulnerability. A physical high privileged attacker could potentially exploit this
vulnerability leading to arbitrary writes to SMRAM.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://www.dell.com/support/kbdoc/en-us/000223210/dsa-2024-104-security-update-for-dell-poweredge-server-bios-for-an-improper-smm-communication-buffer-verification-vulnerability
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1e9797a3");
  script_set_attribute(attribute:"solution", value:
"Apply the security patch in accordance with the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:N/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:P/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-25942");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/03/18");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/03/18");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/10/03");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:dell:bios");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("bios_get_info_wmi.nbin");
  script_require_keys("BIOS/Model", "BIOS/Version", "BIOS/Vendor");

  exit(0);
}

include('vcf_extras.inc');

var app_name = 'Dell Inc.';
var app_info = vcf::dell_bios_win::get_app_info(app:app_name);
var model = app_info['model'];

var fix = '';
# Check model
if (model)
{
  if (model == 'PowerEdge R730') fix = '2.19.0';
  else if (model == 'PowerEdge R730xd') fix = '2.19.0';
  else if (model == 'PowerEdge R630') fix = '2.19.0';
  else if (model == 'PowerEdge C4130') fix = '2.19.0';
  else if (model == 'PowerEdge R930') fix = '2.14.0';
  else if (model == 'PowerEdge M630') fix = '2.19.0';
  else if (model == 'PowerEdge M630 (VRTX)') fix = '2.19.0';
  else if (model == 'PowerEdge FC630') fix = '2.19.0';
  else if (model == 'PowerEdge FC430') fix = '2.19.0';
  else if (model == 'PowerEdge M830') fix = '2.19.0';
  else if (model == 'PowerEdge M830 (VRTX)') fix = '2.19.0';
  else if (model == 'PowerEdge FC830') fix = '2.19.0';
  else if (model == 'PowerEdge T630') fix = '2.19.0';
  else if (model == 'PowerEdge R530') fix = '2.19.0';
  else if (model == 'PowerEdge R430') fix = '2.19.0';
  else if (model == 'PowerEdge T430') fix = '2.19.0';
  else if (model == 'PowerEdge R830') fix = '1.19.0';
  else if (model == 'PowerEdge C6320') fix = '2.19.0';
  else if (model == 'Dell Storage NX3230') fix = '2.19.0';
  else if (model == 'Dell Storage NX3330') fix = '2.19.0';
  else if ('Dell EMC XC Core XC6320' >< model) fix = '2.19.0';
  else if ('Dell EMC XC Core XC430' >< model) fix = '2.19.0';
  else if ('Dell EMC XC Core XC630' >< model) fix = '2.19.0';
  else if ('Dell EMC XC Core XC730' >< model) fix = '2.19.0';
  else if ('Dell EMC XC Core XC730xd' >< model) fix = '2.19.0';
  else
  {
    audit(AUDIT_HOST_NOT, 'an affected model');
  }
}
else
{
  exit(0, 'The model of the device running the Dell BIOS could not be identified.');
}

var constraints = [{ 'fixed_version' : fix, 'fixed_display': fix + ' for ' + model }];
# Have a more useful audit message
app_info.app = 'Dell System BIOS for ' + model;

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);