Strix
26.1K

CVE-2022-34398

HIGHCVSS 7/10EPSS 0.16%

Last modified

CVE-2022-34398 is a high-severity vulnerability rated 7/10 on the CVSS scale. Dell BIOS contains a Time-of-check Time-of-use vulnerability. A local authenticated malicious user could\u00a0potentially exploit this vulnerability by using a specifically timed DMA transaction during an SMI to gain arbitrary code execution on the system. . EPSS estimates a 0.16% chance of exploitation in the next 30 days.

Description

Dell BIOS contains a Time-of-check Time-of-use vulnerability. A local authenticated malicious user could\u00a0potentially exploit this vulnerability by using a specifically timed DMA transaction during an SMI to gain arbitrary code execution on the system.

Metrics

CVSS 3.1
7/10

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
0.16%

5.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
DellAlienware Area 51m R1 Firmware< 1.22.2
DellAlienware Area 51m R2 Firmware< 1.19.0
DellAlienware Aurora R10 Firmware< 2.3.2
DellAlienware Aurora R11 Firmware< 1.0.17
DellAlienware Aurora R12 Firmware< 1.1.17
DellAlienware Aurora R13 Firmware< 1.7.0
DellAlienware Aurora R8 Firmware< 1.0.26
DellAlienware Aurora R9 Firmware< 1.0.22
DellAlienware M15 R1 Firmware< 2.15.0
DellAlienware M15 R2 Firmware< 1.18.3
DellAlienware M15 R3 Firmware< 1.20.0
DellAlienware M15 R4 Firmware< 1.14.0
DellAlienware M17 R1 Firmware< 2.15.0
DellAlienware M17 R2 Firmware< 1.18.3
DellAlienware M17 R3 Firmware< 1.20.0
DellAlienware M17 R4 Firmware< 1.14.0
DellAlienware X14 Firmware< 1.7.0
DellAlienware X15 R1 Firmware< 1.14.0
DellAlienware X15 R2 Firmware< 1.8.2
DellAlienware X17 R1 Firmware< 1.14.0
DellAlienware X17 R2 Firmware< 1.8.2
DellAurora R14 Firmware< 2.5.0
DellChengming 3980 Firmware< 2.26.0
DellChengming 3988 Firmware< 1.13.0
DellChengming 3990 Firmware< 1.16.2
DellChengming 3991 Firmware< 1.16.2
DellDell G3 15 3590 Firmware< 1.19.0
DellDell G3 3579 Firmware< 1.24.0
DellDell G3 3779 Firmware< 1.24.0
DellDell G5 15 5590 Firmware< 1.22.0
DellDell G5 5000 Firmware< 1.11.0
DellDell G5 5090 Firmware< 1.17.0
DellDell G7 15 7590 Firmware< 1.22.0
DellDell G7 17 7790 Firmware< 1.22.0
DellDell Latitude 3480 Firmware< 1.23.0
DellDell Latitude 3580 Firmware< 1.23.0
DellEdge Gateway 3000 Firmware< 1.10.0
DellEdge Gateway 5000 Firmware< 1.20.0
DellEmbedded Box Pc 3000 Firmware< 1.16.0
DellEmbedded Box Pc 3000 Firmware1.16.0
DellEmbedded Box Pc 5000 Firmware< 1.18.0
DellInspiron 3280 Firmware< 1.17.2
DellInspiron 3470 Firmware< 2.26.0
DellInspiron 3471 Firmware< 1.13.0
DellInspiron 3480 Firmware< 1.21.0
DellInspiron 3481 Firmware< 1.20.0
DellInspiron 3482 Firmware< 1.17.0
DellInspiron 3502 Firmware< 1.10.1
DellInspiron 3510 Firmware< 1.11.1
DellInspiron 3521 Firmware< 1.6.1

Showing 50 of 241 affected configurations. See NVD for the full list.

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2022-34398?
Dell BIOS contains a Time-of-check Time-of-use vulnerability. A local authenticated malicious user could\u00a0potentially exploit this vulnerability by using a specifically timed DMA transaction during an SMI to gain arbitrary code execution on the system.
How severe is CVE-2022-34398?
CVE-2022-34398 has a CVSS score of 7/10 (HIGH severity). The EPSS model estimates a 0.16% probability of exploitation in the next 30 days.
How do I fix CVE-2022-34398?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2022-34398?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST