CVE-2024-38304
Low
Description
Dell PowerEdge Platform, 14G Intel BIOS version(s) prior to 2.22.x, contains an Access of Memory Location After End of Buffer vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.
SeverityLow
CVSS3.8
Exploit probability—
ProductDell Poweredge Xe7440 Firmware
PublishedAug 29, 2024
First seenAug 29, 2024
Weakness typeCWE-788CWE-788
How to fix
Update
- dell poweredge_xe7440_firmware2.22.2 or later
- dell emc_xc_core_xcxr2_firmware2.22.1 or later
- dell emc_xc_core_xc940_system_firmware2.22.2 or later
- dell emc_xc_core_xc740xd2_firmware2.22.1 or later
- dell emc_xc_core_xc740xd_system_firmware2.22.2 or later
- dell emc_xc_core_xc640_system_firmware2.22.2 or later
- dell emc_xc_core_6420_system_firmware2.22.2 or later
- dell emc_storage_nx3340_firmware2.22.2 or later
- dell emc_storage_nx3240_firmware2.22.2 or later
- dell poweredge_xe7420_firmware2.22.2 or later
- dell poweredge_xe2420_firmware2.22.2 or later
- dell dss_8440_firmware2.22.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dell poweredge_xe7440_firmware | v < 2.22.2 | 2.22.2 |
| dell emc_xc_core_xcxr2_firmware | v < 2.22.1 | 2.22.1 |
| dell emc_xc_core_xc940_system_firmware | v < 2.22.2 | 2.22.2 |
| dell emc_xc_core_xc740xd2_firmware | v < 2.22.1 | 2.22.1 |
| dell emc_xc_core_xc740xd_system_firmware | v < 2.22.2 | 2.22.2 |
| dell emc_xc_core_xc640_system_firmware | v < 2.22.2 | 2.22.2 |
| dell emc_xc_core_6420_system_firmware | v < 2.22.2 | 2.22.2 |
| dell emc_storage_nx3340_firmware | v < 2.22.2 | 2.22.2 |
| dell emc_storage_nx3240_firmware | v < 2.22.2 | 2.22.2 |
| dell poweredge_xe7420_firmware | v < 2.22.2 | 2.22.2 |
| dell poweredge_xe2420_firmware | v < 2.22.2 | 2.22.2 |
| dell dss_8440_firmware | v < 2.22.2 | 2.22.2 |
| dell poweredge_c4140_firmware | v < 2.22.2 | 2.22.2 |
| dell poweredge_mx840c_firmware | v < 2.22.1 | 2.22.1 |
| dell poweredge_mx740c_firmware | v < 2.22.1 | 2.22.1 |
| dell poweredge_m640_\(for_pe_vrtx\)_firmware | v < 2.22.2 | 2.22.2 |
| dell poweredge_m640_firmware | v < 2.22.2 | 2.22.2 |
| dell poweredge_fc640_firmware | v < 2.22.2 | 2.22.2 |
| dell poweredge_c6420_firmware | v < 2.22.2 | 2.22.2 |
| dell poweredge_t640_firmware | v < 2.22.1 | 2.22.1 |
| dell poweredge_r940xa_firmware | v < 2.22.1 | 2.22.1 |
| dell poweredge_r840_firmware | v < 2.22.1 | 2.22.1 |
| dell poweredge_r740xd2_firmware | v < 2.22.1 | 2.22.1 |
| dell poweredge_xr2_firmware | v < 2.22.1 | 2.22.1 |
| dell poweredge_t440_firmware | v < 2.22.1 | 2.22.1 |
| dell poweredge_r440_firmware | v < 2.22.1 | 2.22.1 |
| dell poweredge_r540_firmware | v < 2.22.1 | 2.22.1 |
| dell poweredge_r940_firmware | v < 2.22.2 | 2.22.2 |
| dell poweredge_r640_firmware | v < 2.22.2 | 2.22.2 |
| dell poweredge_r740xd_firmware | v < 2.22.2 | 2.22.2 |
| dell poweredge_r740_firmware | v < 2.22.2 | 2.22.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.