CVE-2022-31222 — Missing Release of Memory after Effective Lifetime in Dell CPG Bios

CWE-401 — Missing Release of Memory after Effective LifetimeCWE-772 — Missing Release of Resource after Effective Lifetime3 documents3 sources
Severity
4.4MEDIUMNVD
CNA2.3
EPSS
0.0%
top 86.89%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
26
Dell CPG BiosDell Chengming 3900 FirmwareDell Inspiron 14 Plus 7420 Firmware+23 more
Timeline
PublishedSep 12
Latest updateSep 13

Description

Dell BIOS versions contain a Missing Release of Resource after Effective Lifetime vulnerability. A local authenticated administrator user could potentially exploit this vulnerability by consuming excess memory in order to cause the application to crash.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:HExploitability: 0.8 | Impact: 3.6

Affected Packages26 packages

▶CVEListV5dell/cpg_biosunspecified — 21Q4 platforms

Patches

Patch: www.dell.com ↗Patch: www.dell.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-9r29-9qmj-8m4x: Dell BIOS versions contain a Missing Release of Resource after Effective Lifetime vulnerability↗2022-09-13
▶
CVEList
CVE-2022-31222: Dell BIOS versions contain a Missing Release of Resource after Effective Lifetime vulnerability↗2022-09-12
▶
CVE-2022-31222 — Dell CPG Bios vulnerability | cvebase