CVE-2022-24419 : Dell BIOS contains an improper input validation vulnerability. A local authentic

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM.

Published 2022-03-11 22:15:13

Updated 2023-06-30 18:41:09

Source Dell

View at NVD, CVE.org

Vulnerability category: Overflow

Products affected by CVE-2022-24419

Dell » Embedded Box Pc 5000 Firmware
Versions before (<) 1.14.0
cpe:2.3:o:dell:embedded_box_pc_5000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Embedded Box Pc 5000 » Version: N/A
Dell » Latitude 3379 Firmware
Versions before (<) 1.0.34
cpe:2.3:o:dell:latitude_3379_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Latitude 3379 » Version: N/A
Dell » Vostro 3267 Firmware
Versions before (<) 1.20.0
cpe:2.3:o:dell:vostro_3267_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Vostro 3267 » Version: N/A
Dell » Vostro 3268 Firmware
Versions before (<) 1.20.0
cpe:2.3:o:dell:vostro_3268_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Vostro 3268 » Version: N/A
Dell » Vostro 3660 Firmware
Versions before (<) 1.20.0
cpe:2.3:o:dell:vostro_3660_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Vostro 3660 » Version: N/A
Dell » Vostro 3667 Firmware
Versions before (<) 1.20.0
cpe:2.3:o:dell:vostro_3667_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Vostro 3667 » Version: N/A
Dell » Vostro 3668 Firmware
Versions before (<) 1.20.0
cpe:2.3:o:dell:vostro_3668_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Vostro 3668 » Version: N/A
Dell » Vostro 3669 Firmware
Versions before (<) 1.20.0
cpe:2.3:o:dell:vostro_3669_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Vostro 3669 » Version: N/A
Dell » Inspiron 14 3473 Firmware
Versions before (<) 1.14.0
cpe:2.3:o:dell:inspiron_14_3473_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 14 3473 » Version: N/A
Dell » Inspiron 15 5566 Firmware
Versions before (<) 1.18.0
cpe:2.3:o:dell:inspiron_15_5566_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 15 5566 » Version: N/A
Dell » Vostro 14 5468 Firmware
Versions before (<) 1.19.0
cpe:2.3:o:dell:vostro_14_5468_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Vostro 14 5468 » Version: N/A
Dell » Vostro 15 5568 Firmware
Versions before (<) 1.19.0
cpe:2.3:o:dell:vostro_15_5568_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Vostro 15 5568 » Version: N/A
Dell » Wyse 7040 Thin Client Firmware
Versions before (<) 1.15.0
cpe:2.3:o:dell:wyse_7040_thin_client_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Wyse 7040 Thin Client » Version: N/A
Dell » Alienware 13 R3 Firmware
Versions before (<) 1.16.1
cpe:2.3:o:dell:alienware_13_r3_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Alienware 13 R3 » Version: N/A
Dell » Alienware 15 R3 Firmware
Versions before (<) 1.16.1
cpe:2.3:o:dell:alienware_15_r3_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Alienware 15 R3 » Version: N/A
Dell » Alienware 15 R4 Firmware
Versions before (<) 1.17.0
cpe:2.3:o:dell:alienware_15_r4_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Alienware 15 R4 » Version: N/A
Dell » Alienware 17 R4 Firmware
Versions before (<) 1.16.1
cpe:2.3:o:dell:alienware_17_r4_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Alienware 17 R4 » Version: N/A
Dell » Alienware 17 R5 Firmware
Versions before (<) 1.17.0
cpe:2.3:o:dell:alienware_17_r5_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Alienware 17 R5 » Version: N/A
Dell » Alienware Area 51m R1 Firmware
Versions before (<) 1.18.0
cpe:2.3:o:dell:alienware_area_51m_r1_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Alienware Area 51m R1 » Version: N/A
Dell » Alienware Area 51m R2 Firmware
Versions before (<) 1.13.0
cpe:2.3:o:dell:alienware_area_51m_r2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Alienware Area 51m R2 » Version: N/A
Dell » Alienware Aurora R8 Firmware
Versions before (<) 1.0.20
cpe:2.3:o:dell:alienware_aurora_r8_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Alienware Aurora R8 » Version: N/A
Dell » Alienware M15 R2 Firmware
Versions before (<) 1.12.0
cpe:2.3:o:dell:alienware_m15_r2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Alienware M15 R2 » Version: N/A
Dell » Alienware M15 R3 Firmware
Versions before (<) 1.14.0
cpe:2.3:o:dell:alienware_m15_r3_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Alienware M15 R3 » Version: N/A
Dell » Alienware M17 R2 Firmware
Versions before (<) 1.12.0
cpe:2.3:o:dell:alienware_m17_r2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Alienware M17 R2 » Version: N/A
Dell » Alienware M17 R3 Firmware
Versions before (<) 1.14.0
cpe:2.3:o:dell:alienware_m17_r3_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Alienware M17 R3 » Version: N/A
Dell » Alienware X15 R1 Firmware
Versions before (<) 1.7.0
cpe:2.3:o:dell:alienware_x15_r1_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Alienware X15 R1 » Version: N/A
Dell » Alienware X17 R1 Firmware
Versions before (<) 1.7.0
cpe:2.3:o:dell:alienware_x17_r1_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Alienware X17 R1 » Version: N/A
Dell » Inspiron 3277 Firmware
Versions before (<) 1.19.0
cpe:2.3:o:dell:inspiron_3277_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 3277 » Version: N/A
Dell » Inspiron 3477 Firmware
Versions before (<) 1.19.0
cpe:2.3:o:dell:inspiron_3477_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 3477 » Version: N/A
Dell » Xps 8930 Firmware
Versions before (<) 1.1.21
cpe:2.3:o:dell:xps_8930_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Xps 8930 » Version: N/A
Dell » Alienware M15 R4 Firmware
Versions before (<) 1.8.0
cpe:2.3:o:dell:alienware_m15_r4_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Alienware M15 R4 » Version: N/A
Dell » Alienware M17 R4 Firmware
Versions before (<) 1.8.0
cpe:2.3:o:dell:alienware_m17_r4_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Alienware M17 R4 » Version: N/A
Dell » Inspiron 15 3573 Firmware
Versions before (<) 1.14.0
cpe:2.3:o:dell:inspiron_15_3573_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 15 3573 » Version: N/A
Dell » Inspiron 3482 Firmware
Versions before (<) 1.13.0
cpe:2.3:o:dell:inspiron_3482_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 3482 » Version: N/A
Dell » Inspiron 3502 Firmware
Versions before (<) 1.7.0
cpe:2.3:o:dell:inspiron_3502_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 3502 » Version: N/A
Dell » Inspiron 3510 Firmware
Versions before (<) 1.6.0
cpe:2.3:o:dell:inspiron_3510_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 3510 » Version: N/A
Dell » Inspiron 3582 Firmware
Versions before (<) 1.13.0
cpe:2.3:o:dell:inspiron_3582_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 3582 » Version: N/A
Dell » Inspiron 3782 Firmware
Versions before (<) 1.13.0
cpe:2.3:o:dell:inspiron_3782_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 3782 » Version: N/A
Dell » Edge Gateway 3000 Firmware
Versions before (<) 1.7.0
cpe:2.3:o:dell:edge_gateway_3000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Edge Gateway 3000 » Version: N/A
Dell » Edge Gateway 5000 Firmware
Versions before (<) 1.17.0
cpe:2.3:o:dell:edge_gateway_5000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Edge Gateway 5000 » Version: N/A
Dell » Edge Gateway 5100 Firmware
Versions before (<) 1.17.0
cpe:2.3:o:dell:edge_gateway_5100_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Edge Gateway 5100 » Version: N/A
Dell » Embedded Box Pc 3000 Firmware
Versions before (<) 1.13.0
cpe:2.3:o:dell:embedded_box_pc_3000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Embedded Box Pc 3000 » Version: N/A
Dell » Inspiron 3465 Firmware
Versions before (<) 1.12.0
cpe:2.3:o:dell:inspiron_3465_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 3465 » Version: N/A
Dell » Inspiron 3565 Firmware
Versions before (<) 1.12.0
cpe:2.3:o:dell:inspiron_3565_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Inspiron 3565 » Version: N/A
Dell » Vostro 3572 Firmware
Versions before (<) 1.14.0
cpe:2.3:o:dell:vostro_3572_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Vostro 3572 » Version: N/A
Dell » Vostro 3582 Firmware
Versions before (<) 1.13.0
cpe:2.3:o:dell:vostro_3582_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Vostro 3582 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2022-24419

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 6 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-24419

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.2	HIGH	AV:L/AC:L/Au:N/C:C/I:C/A:C	3.9	10.0	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
8.2	HIGH	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H	1.5	6.0	Dell
Attack Vector: Local Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2022-24419

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Assigned by: nvd@nist.gov (Primary)
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Assigned by:
- nvd@nist.gov (Primary)
- security_alert@emc.com (Secondary)

References for CVE-2022-24419

https://www.dell.com/support/kbdoc/en-us/000197057/dsa-2022-053

Access Denied
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2022-24419

Products affected by CVE-2022-24419

Exploit prediction scoring system (EPSS) score for CVE-2022-24419

CVSS scores for CVE-2022-24419

CWE ids for CVE-2022-24419

References for CVE-2022-24419