CVE-2022-34399 Information disclosure in CPG BIOS
A malicious admin can exploit a buffer access flaw in Dell Alienware BIOS to leak sensitive SMRAM sections.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-34399?
CVE-2022-34399 is a medium-severity vulnerability in Dell CPG BIOS, published on 18 Jan 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Dell Alienware m17 R5 BIOS version prior to 1.2.2 contain a buffer access vulnerability. A malicious user with admin privileges could potentially exploit this vulnerability by sending input larger than expected in order to leak certain sections of SMRAM.
Which versions are affected by CVE-2022-34399?
It affects 15 products.
Products include Dell Alienware M15 A6 Firmware, Dell Alienware M15 Ryzen Edition R5 Firmware, Dell Alienware M17 Ryzen Edition R5 Firmware, Dell G15 5515 Firmware, Dell G15 5525 Firmware, Dell Inspiron 3505 Firmware and 9 more.
How do I fix CVE-2022-34399?
No fix has been published for CVE-2022-34399 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-34399 being exploited?
There is no known exploitation of CVE-2022-34399 in the wild and no public exploit code.
Other vulnerabilities in Dell CPG BIOS
Sources
Also known as GHSA-xcr3-2hg5-6c3w.