CVE-2022-22558 Memory corruption in PowerEdge Platform

Medium 5.7 Published 21 Apr 2022 Updated 17 Sep 2024

A local high-privileged attacker can exploit improper SMM buffer verification in Dell BIOS to achieve arbitrary writes or cause denial of service.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-22558?

CVE-2022-22558 is a medium-severity memory corruption vulnerability in Dell PowerEdge Platform, published on 21 Apr 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Dell PowerEdge Server BIOS and Dell Precision Workstation 7910 and 7920 Rack BIOS contain an Improper SMM communication buffer verification vulnerability. A Local High Privileged attacker could potentially exploit this vulnerability leading to arbitrary writes or denial of service.

Weakness: CWE-119

Which versions are affected by CVE-2022-22558?

It affects 20 products.

Products include Dell C4130 Firmware, Dell C6320 Firmware, Dell Fc430 Firmware, Dell Fc630 Firmware, Dell Fc830 Firmware, Dell M630 Firmware and 14 more.

How do I fix CVE-2022-22558?

No fix has been published for CVE-2022-22558 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2022-22558 being exploited?

There is no known exploitation of CVE-2022-22558 in the wild and no public exploit code.

Sources

Also known as GHSA-mvr6-2vwj-5j5r.