Sign-up

ID

VAR-202203-1379


CVE

CVE-2022-24420


TITLE

Buffer Error Vulnerability in Multiple Dell Products

Trust: 0.8

sources: JVNDB: JVNDB-2022-006720

DESCRIPTION

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM. Alienware 13 R3 firmware, Alienware 15 R3 firmware, Alienware 15 R4 Multiple Dell products, such as firmware, contain a buffer error vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Trust: 1.62

sources: NVD: CVE-2022-24420 // JVNDB: JVNDB-2022-006720

AFFECTED PRODUCTS

vendor:dellmodel:vostro 3268scope:ltversion:1.20.0

Trust: 1.0

vendor:dellmodel:alienware x15 r1scope:ltversion:1.7.0

Trust: 1.0

vendor:dellmodel:vostro 3667scope:ltversion:1.20.0

Trust: 1.0

vendor:dellmodel:alienware 17 r5scope:ltversion:1.17.0

Trust: 1.0

vendor:dellmodel:alienware m17 r4scope:ltversion:1.8.0

Trust: 1.0

vendor:dellmodel:vostro 3669scope:ltversion:1.20.0

Trust: 1.0

vendor:dellmodel:inspiron 3465scope:ltversion:1.12.0

Trust: 1.0

vendor:dellmodel:edge gateway 5100scope:ltversion:1.17.0

Trust: 1.0

vendor:dellmodel:inspiron 3477scope:ltversion:1.19.0

Trust: 1.0

vendor:dellmodel:inspiron 3582scope:ltversion:1.13.0

Trust: 1.0

vendor:dellmodel:alienware aurora r8scope:ltversion:1.0.20

Trust: 1.0

vendor:dellmodel:alienware m15 r3scope:ltversion:1.14.0

Trust: 1.0

vendor:dellmodel:embedded box pc 3000scope:ltversion:1.13.0

Trust: 1.0

vendor:dellmodel:vostro 3668scope:ltversion:1.20.0

Trust: 1.0

vendor:dellmodel:vostro 15 5568scope:ltversion:1.19.0

Trust: 1.0

vendor:dellmodel:vostro 14 5468scope:ltversion:1.19.0

Trust: 1.0

vendor:dellmodel:alienware m15 r2scope:ltversion:1.12.0

Trust: 1.0

vendor:dellmodel:alienware 13 r3scope:ltversion:1.16.1

Trust: 1.0

vendor:dellmodel:alienware 15 r4scope:ltversion:1.17.0

Trust: 1.0

vendor:dellmodel:alienware x17 r1scope:ltversion:1.7.0

Trust: 1.0

vendor:dellmodel:latitude 3379scope:ltversion:1.0.34

Trust: 1.0

vendor:dellmodel:inspiron 3482scope:ltversion:1.13.0

Trust: 1.0

vendor:dellmodel:embedded box pc 5000scope:ltversion:1.14.0

Trust: 1.0

vendor:dellmodel:inspiron 15 3573scope:ltversion:1.14.0

Trust: 1.0

vendor:dellmodel:alienware 15 r3scope:ltversion:1.16.1

Trust: 1.0

vendor:dellmodel:wyse 7040 thin clientscope:ltversion:1.15.0

Trust: 1.0

vendor:dellmodel:vostro 3660scope:ltversion:1.20.0

Trust: 1.0

vendor:dellmodel:vostro 3582scope:ltversion:1.13.0

Trust: 1.0

vendor:dellmodel:xps 8930scope:ltversion:1.1.21

Trust: 1.0

vendor:dellmodel:alienware 17 r4scope:ltversion:1.16.1

Trust: 1.0

vendor:dellmodel:edge gateway 3000scope:ltversion:1.7.0

Trust: 1.0

vendor:dellmodel:inspiron 3782scope:ltversion:1.13.0

Trust: 1.0

vendor:dellmodel:vostro 3267scope:ltversion:1.20.0

Trust: 1.0

vendor:dellmodel:edge gateway 5000scope:ltversion:1.17.0

Trust: 1.0

vendor:dellmodel:vostro 3572scope:ltversion:1.14.0

Trust: 1.0

vendor:dellmodel:inspiron 3502scope:ltversion:1.7.0

Trust: 1.0

vendor:dellmodel:alienware m15 r4scope:ltversion:1.8.0

Trust: 1.0

vendor:dellmodel:inspiron 3277scope:ltversion:1.19.0

Trust: 1.0

vendor:dellmodel:inspiron 3565scope:ltversion:1.12.0

Trust: 1.0

vendor:dellmodel:inspiron 14 3473scope:ltversion:1.14.0

Trust: 1.0

vendor:dellmodel:inspiron 15 5566scope:ltversion:1.18.0

Trust: 1.0

vendor:dellmodel:alienware m17 r3scope:ltversion:1.14.0

Trust: 1.0

vendor:dellmodel:alienware m17 r2scope:ltversion:1.12.0

Trust: 1.0

vendor:dellmodel:alienware area 51m r1scope:ltversion:1.18.0

Trust: 1.0

vendor:dellmodel:alienware area 51m r2scope:ltversion:1.13.0

Trust: 1.0

vendor:dellmodel:inspiron 3510scope:ltversion:1.6.0

Trust: 1.0

vendor:デルmodel:alienware area 51m r1scope: - version: -

Trust: 0.8

vendor:デルmodel:alienware m15 r3scope: - version: -

Trust: 0.8

vendor:デルmodel:alienware 17 r4scope: - version: -

Trust: 0.8

vendor:デルmodel:alienware 17 r5scope: - version: -

Trust: 0.8

vendor:デルmodel:alienware aurora r8scope: - version: -

Trust: 0.8

vendor:デルmodel:alienware 15 r3scope: - version: -

Trust: 0.8

vendor:デルmodel:alienware 13 r3scope: - version: -

Trust: 0.8

vendor:デルmodel:alienware area 51m r2scope: - version: -

Trust: 0.8

vendor:デルmodel:alienware m15 r2scope: - version: -

Trust: 0.8

vendor:デルmodel:alienware 15 r4scope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2022-006720 // NVD: CVE-2022-24420

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-24420
value: HIGH

Trust: 1.0

security_alert@emc.com: CVE-2022-24420
value: HIGH

Trust: 1.0

NVD: CVE-2022-24420
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202203-1203
value: HIGH

Trust: 0.6

nvd@nist.gov: CVE-2022-24420
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

nvd@nist.gov: CVE-2022-24420
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 1.0

security_alert@emc.com: CVE-2022-24420
baseSeverity: HIGH
baseScore: 8.2
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.5
impactScore: 6.0
version: 3.1

Trust: 1.0

NVD: CVE-2022-24420
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2022-006720 // CNNVD: CNNVD-202203-1203 // NVD: CVE-2022-24420 // NVD: CVE-2022-24420

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.0

problemtype:Buffer error (CWE-119) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2022-006720 // NVD: CVE-2022-24420

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202203-1203

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202203-1203

PATCH

title:Dell BIOS Buffer error vulnerability fixurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=244002

Trust: 0.6

sources: CNNVD: CNNVD-202203-1203

EXTERNAL IDS

db:NVDid:CVE-2022-24420

Trust: 3.2

db:JVNDBid:JVNDB-2022-006720

Trust: 0.8

db:CNNVDid:CNNVD-202203-1203

Trust: 0.6

sources: JVNDB: JVNDB-2022-006720 // CNNVD: CNNVD-202203-1203 // NVD: CVE-2022-24420

REFERENCES

url:https://www.dell.com/support/kbdoc/en-us/000197057/dsa-2022-053

Trust: 2.4

url:https://nvd.nist.gov/vuln/detail/cve-2022-24420

Trust: 0.8

url:https://cxsecurity.com/cveshow/cve-2022-24420/

Trust: 0.6

sources: JVNDB: JVNDB-2022-006720 // CNNVD: CNNVD-202203-1203 // NVD: CVE-2022-24420

SOURCES

db:JVNDBid:JVNDB-2022-006720
db:CNNVDid:CNNVD-202203-1203
db:NVDid:CVE-2022-24420

LAST UPDATE DATE

2024-08-14T15:01:06.134000+00:00


SOURCES UPDATE DATE

db:JVNDBid:JVNDB-2022-006720date:2023-07-07T08:27:00
db:CNNVDid:CNNVD-202203-1203date:2023-07-03T00:00:00
db:NVDid:CVE-2022-24420date:2023-06-30T18:41:12.827

SOURCES RELEASE DATE

db:JVNDBid:JVNDB-2022-006720date:2023-07-07T00:00:00
db:CNNVDid:CNNVD-202203-1203date:2022-03-11T00:00:00
db:NVDid:CVE-2022-24420date:2022-03-11T22:15:13.547