CVE-2022-34391Improper Restriction of Operations within the Bounds of a Memory Buffer in Dell CPG Bios

Severity
7.8HIGHNVD
CNA7.5
EPSS
0.0%
top 84.86%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedOct 12
Latest updateOct 13

Description

Dell Client BIOS Versions prior to the remediated version contain an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages3 packages

CVEListV5dell/cpg_biosunspecified1.2.15

🔴Vulnerability Details

2
GHSA
GHSA-xvm4-x6jf-7p35: Dell Client BIOS Versions prior to the remediated version contain an improper input validation vulnerability2022-10-13
CVEList
CVE-2022-34391: Dell Client BIOS Versions prior to the remediated version contain an improper input validation vulnerability2022-10-12
CVE-2022-34391 — Dell CPG Bios vulnerability | cvebase