CVE-2022-34398
HIGHCVSS 7/10EPSS 0.16%
Last modified
CVE-2022-34398 is a high-severity vulnerability rated 7/10 on the CVSS scale. Dell BIOS contains a Time-of-check Time-of-use vulnerability. A local authenticated malicious user could\u00a0potentially exploit this vulnerability by using a specifically timed DMA transaction during an SMI to gain arbitrary code execution on the system. . EPSS estimates a 0.16% chance of exploitation in the next 30 days.
Description
Dell BIOS contains a Time-of-check Time-of-use vulnerability. A local authenticated malicious user could\u00a0potentially exploit this vulnerability by using a specifically timed DMA transaction during an SMI to gain arbitrary code execution on the system.
Metrics
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Dell | Alienware Area 51m R1 Firmware | < 1.22.2 |
| Dell | Alienware Area 51m R2 Firmware | < 1.19.0 |
| Dell | Alienware Aurora R10 Firmware | < 2.3.2 |
| Dell | Alienware Aurora R11 Firmware | < 1.0.17 |
| Dell | Alienware Aurora R12 Firmware | < 1.1.17 |
| Dell | Alienware Aurora R13 Firmware | < 1.7.0 |
| Dell | Alienware Aurora R8 Firmware | < 1.0.26 |
| Dell | Alienware Aurora R9 Firmware | < 1.0.22 |
| Dell | Alienware M15 R1 Firmware | < 2.15.0 |
| Dell | Alienware M15 R2 Firmware | < 1.18.3 |
| Dell | Alienware M15 R3 Firmware | < 1.20.0 |
| Dell | Alienware M15 R4 Firmware | < 1.14.0 |
| Dell | Alienware M17 R1 Firmware | < 2.15.0 |
| Dell | Alienware M17 R2 Firmware | < 1.18.3 |
| Dell | Alienware M17 R3 Firmware | < 1.20.0 |
| Dell | Alienware M17 R4 Firmware | < 1.14.0 |
| Dell | Alienware X14 Firmware | < 1.7.0 |
| Dell | Alienware X15 R1 Firmware | < 1.14.0 |
| Dell | Alienware X15 R2 Firmware | < 1.8.2 |
| Dell | Alienware X17 R1 Firmware | < 1.14.0 |
| Dell | Alienware X17 R2 Firmware | < 1.8.2 |
| Dell | Aurora R14 Firmware | < 2.5.0 |
| Dell | Chengming 3980 Firmware | < 2.26.0 |
| Dell | Chengming 3988 Firmware | < 1.13.0 |
| Dell | Chengming 3990 Firmware | < 1.16.2 |
| Dell | Chengming 3991 Firmware | < 1.16.2 |
| Dell | Dell G3 15 3590 Firmware | < 1.19.0 |
| Dell | Dell G3 3579 Firmware | < 1.24.0 |
| Dell | Dell G3 3779 Firmware | < 1.24.0 |
| Dell | Dell G5 15 5590 Firmware | < 1.22.0 |
| Dell | Dell G5 5000 Firmware | < 1.11.0 |
| Dell | Dell G5 5090 Firmware | < 1.17.0 |
| Dell | Dell G7 15 7590 Firmware | < 1.22.0 |
| Dell | Dell G7 17 7790 Firmware | < 1.22.0 |
| Dell | Dell Latitude 3480 Firmware | < 1.23.0 |
| Dell | Dell Latitude 3580 Firmware | < 1.23.0 |
| Dell | Edge Gateway 3000 Firmware | < 1.10.0 |
| Dell | Edge Gateway 5000 Firmware | < 1.20.0 |
| Dell | Embedded Box Pc 3000 Firmware | < 1.16.0 |
| Dell | Embedded Box Pc 3000 Firmware | 1.16.0 |
| Dell | Embedded Box Pc 5000 Firmware | < 1.18.0 |
| Dell | Inspiron 3280 Firmware | < 1.17.2 |
| Dell | Inspiron 3470 Firmware | < 2.26.0 |
| Dell | Inspiron 3471 Firmware | < 1.13.0 |
| Dell | Inspiron 3480 Firmware | < 1.21.0 |
| Dell | Inspiron 3481 Firmware | < 1.20.0 |
| Dell | Inspiron 3482 Firmware | < 1.17.0 |
| Dell | Inspiron 3502 Firmware | < 1.10.1 |
| Dell | Inspiron 3510 Firmware | < 1.11.1 |
| Dell | Inspiron 3521 Firmware | < 1.6.1 |
Showing 50 of 241 affected configurations. See NVD for the full list.
References
- https://www.dell.com/support/kbdoc/000206038Vendor Advisory
- https://www.dell.com/support/kbdoc/000206038Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-34398?
Dell BIOS contains a Time-of-check Time-of-use vulnerability. A local authenticated malicious user could\u00a0potentially exploit this vulnerability by using a specifically timed DMA transaction during an SMI to gain arbitrary code execution on the system.
How severe is CVE-2022-34398?
CVE-2022-34398 has a CVSS score of 7/10 (HIGH severity). The EPSS model estimates a 0.16% probability of exploitation in the next 30 days.
How do I fix CVE-2022-34398?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-34392 SupportAssist for Home PCs (versions 3.11.4 and prior) cont…5.5
- CVE-2022-34393 Dell BIOS contains an improper input validation vulnerabili…7.5
- CVE-2022-34394Dell OS10, version 10.5.3.4, contains an Improper Certificat…3.7
- CVE-2022-34395Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2022-34396 Dell OpenManage Server Administrator (OMSA) version 10.3.0.…7.8
- CVE-2022-34397 Dell Unisphere for PowerMax vApp, VASA Provider vApp, and S…5.7
- CVE-2022-34399 Dell Alienware m17 R5 BIOS version prior to 1.2.2 contain a…2.3
- CVE-2022-3440The Rock Convert WordPress plugin before 2.11.0 does not san…6.1
- CVE-2022-34400 Dell BIOS contains a heap buffer overflow vulnerability. A …7.1
- CVE-2022-34401 Dell BIOS contains a stack based buffer overflow vulnerabil…7.5
- CVE-2022-34402Dell Wyse ThinOS 2205 contains a Regular Expression Denial o…4.9
- CVE-2022-34403 Dell BIOS contains a Stack based buffer overflow vulnerabil…8.8
Are you affected by CVE-2022-34398?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST