CVE-2022-24415 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Dell CPG Bios

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-20 — Improper Input Validation3 documents3 sources
Severity
7.8HIGHNVD
CNA8.2
EPSS
0.0%
top 87.63%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
47
Dell CPG BiosDell Alienware 13 R3 FirmwareDell Alienware 15 R3 Firmware+44 more
Timeline
PublishedMar 11
Latest updateMar 12

Description

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages47 packages

▶CVEListV5dell/cpg_biosunspecified — 1.16

🔴Vulnerability Details

2
GHSA
GHSA-54gg-3w9x-qwch: Dell BIOS contains an improper input validation vulnerability↗2022-03-12
▶
CVEList
CVE-2022-24415: Dell BIOS contains an improper input validation vulnerability↗2022-03-11
▶
CVE-2022-24415 — Dell CPG Bios vulnerability | cvebase