Jiawei Yin

تتعلق المشكلة بالتحقق غير الكافي من صحة المدخلات في معالج SMM، مما قد يسمح لمهاجم يتمتع بامتيازات بالكتابة فوق ذاكرة SMRAM، مما قد يؤدي إلى تنفيذ تعليمات برمجية تعسفية. لم يتم تقديم أي معلومات حول العدد التقديري للأجهزة التي قد تكون متأثرة في جميع أنحاء العالم أو الحوادث الفعلية التي تم فيها استغلال هذه المشكلة.

Name of the Vulnerable Software and Affected Versions: Dell Edge Gateway BIOS versions 3200 and 5200 Description: The issue is related to an out-of-bounds write vulnerability in the Dell Edge Gateway BIOS. A local authenticated malicious user with high privileges could potentially exploit this vulnerability, leading to exposure of some UEFI code, which could result in arbitrary code execution or escalation of privilege. The vulnerability is also associated with incorrect initialization of a resource in the DXE driver of the BIOS firmware. Recommendations: For versions 3200 and 5200, update the BIOS to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to improper input validation in the BIOS firmware, which may allow a privileged user to enable escalation of privilege via local access.

The issue is related to improper input validation in the BIOS firmware, which may allow a privileged user to potentially enable escalation of privilege via local access.

The issue is related to improper input validation in the BIOS firmware for some Intel(R) Processors. This may allow a privileged user to potentially enable escalation of privilege via local access.

The issue is related to an improper input validation vulnerability in Dell BIOS. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.

The issue is related to a failure to verify the protocol in SMM, which may allow an attacker to control the protocol and modify SPI flash, potentially resulting in arbitrary code execution.