CVE-2024-0171

Dell PowerEdge Server BIOS contains an TOCTOU race condition vulnerability. A local low privileged attacker could potentially exploit this vulnerability to gain access to otherwise unauthorized resources.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.1 / Impact : 3.7

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://www.dell.com/support/kbdoc/en-us/000226253/dsa-2024-039-security-update-for-dell-amd-based-poweredge-server-vulnerability	Vendor Advisory
https://www.dell.com/support/kbdoc/en-us/000226253/dsa-2024-039-security-update-for-dell-amd-based-poweredge-server-vulnerability	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:dell:poweredge_r6615_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:dell:poweredge_r6615:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:dell:poweredge_r7615_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:dell:poweredge_r7615:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:dell:poweredge_r6625_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:dell:poweredge_r6625:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND

cpe:2.3:o:dell:poweredge_r7625_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:dell:poweredge_r7625:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND

cpe:2.3:o:dell:poweredge_c6615_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:dell:poweredge_c6615:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND

cpe:2.3:o:dell:xc_core_xc7625_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:dell:xc_core_xc7625:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-06-25 16:15

Updated : 2024-11-21 08:45

NVD link : CVE-2024-0171

Mitre link : CVE-2024-0171

CVE.ORG link : CVE-2024-0171

JSON object : View

Products Affected

dell

poweredge_r6615_firmware
poweredge_r7625_firmware
poweredge_c6615_firmware
xc_core_xc7625
poweredge_r6625_firmware
poweredge_r7615
poweredge_r7615_firmware
poweredge_c6615
xc_core_xc7625_firmware
poweredge_r6625
poweredge_r7625
poweredge_r6615

CWE

CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

{"id": "CVE-2024-0171", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security_alert@emc.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 1.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 1.1}]}, "published": "2024-06-25T16:15:24.197", "references": [{"url": "https://www.dell.com/support/kbdoc/en-us/000226253/dsa-2024-039-security-update-for-dell-amd-based-poweredge-server-vulnerability", "tags": ["Vendor Advisory"], "source": "security_alert@emc.com"}, {"url": "https://www.dell.com/support/kbdoc/en-us/000226253/dsa-2024-039-security-update-for-dell-amd-based-poweredge-server-vulnerability", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security_alert@emc.com", "description": [{"lang": "en", "value": "CWE-367"}]}], "descriptions": [{"lang": "en", "value": "Dell PowerEdge Server BIOS contains an TOCTOU race condition vulnerability. A local low privileged attacker could potentially exploit this vulnerability to gain access to otherwise unauthorized resources."}, {"lang": "es", "value": "Dell PowerEdge Server BIOS contiene una vulnerabilidad de condici\u00f3n de ejecuci\u00f3n TOCTOU. Un atacante local con pocos privilegios podr\u00eda explotar esta vulnerabilidad para obtener acceso a recursos que de otro modo no estar\u00edan autorizados."}], "lastModified": "2024-11-21T08:45:59.980", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dell:poweredge_r6615_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8E330219-A0B2-4C66-B4BE-07CB5D21B819", "versionEndExcluding": "1.8.3"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dell:poweredge_r6615:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "73077527-E12D-495C-AB91-C35109AE4C43"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dell:poweredge_r7615_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "304F6677-C563-402A-B0F1-2BBBBAF2E183", "versionEndExcluding": "1.8.3"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dell:poweredge_r7615:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A74500E4-ADD2-4134-8D60-F4285C158F93"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dell:poweredge_r6625_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "40AB1808-81AA-460E-B6E7-FD54BB5735ED", "versionEndExcluding": "1.8.3"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dell:poweredge_r6625:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "09981777-C86C-4BC6-8834-97E8A2551897"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dell:poweredge_r7625_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C7FE22FE-2AB9-4879-B0F5-F20E684ED024", "versionEndExcluding": "1.8.3"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dell:poweredge_r7625:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2F074158-252A-4C51-B80C-1B94E22A364A"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dell:poweredge_c6615_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AFAABA0C-5DD7-4928-9A91-A560366F3054", "versionEndExcluding": "1.3.3"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dell:poweredge_c6615:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "788C678A-92CF-45BD-99D5-AF18394C9860"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dell:xc_core_xc7625_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EE5A04A2-5525-4286-BB76-9FCA7BB1F58A", "versionEndExcluding": "1.8.3"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dell:xc_core_xc7625:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "575F1C0C-37A7-45CF-86B1-7F56E14D211C"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "security_alert@emc.com"}