CVE-2024-42425

Description

Dell Precision Rack, 14G Intel BIOS versions prior to 2.22.2, contains an Access of Memory Location After End of Buffer vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.

CVSS v3.1 Score

3.8

LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Weakness Type (CWE)

CWE-788 CWE-788

CWE-119 Buffer Overflow

Affected Products

Vendor	Product	Versions
dell	precision_7920_firmware	< 2.22.1
dell	precision_7920	All
dell	7920_xl_firmware	< 2.22.1
dell	7920_xl	All

References

Advisories & Patches

https://www.dell.com/support/kbdoc/en-us/000227015/dsa-2024-328

Frequently Asked Questions

What is CVE-2024-42425? +

Dell Precision Rack, 14G Intel BIOS versions prior to 2.22.2, contains an Access of Memory Location After End of Buffer vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure. It has a CVSS v3.1 base score of 3.8 (LOW).

How severe is CVE-2024-42425? +

CVE-2024-42425 has a CVSS v3.1 score of 3.8 out of 10, rated LOW. This is a low-severity vulnerability with limited impact.

What products are affected by CVE-2024-42425? +

CVE-2024-42425 affects products from dell, specifically: 7920_xl, 7920_xl_firmware, precision_7920, precision_7920_firmware. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-42425? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2023-20585

Insufficient checks of the RMP on host buffer access in IOMMU may allow an attacker with privileges and a compromised …

CVE-2024-20402 8.6

A vulnerability in the SSL VPN feature for Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) …

CVE-2024-20330 8.6

A vulnerability in the Snort 2 and Snort 3 TCP and UDP detection engine of Cisco Firepower Threat Defense (FTD) …

CVE-2024-27829 7.8

The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.5. Processing a file may …

CVE-2024-27828 7.8

The issue was addressed with improved memory handling. This issue is fixed in iOS 17.5 and iPadOS 17.5, tvOS 17.5, …

CVE-2024-0074 7.1

NVIDIA GPU Display Driver for Linux contains a vulnerability where an attacker may access a memory location after the end …