CVE-2024-0171
📋 TL;DR
Dell PowerEdge Server BIOS contains a Time-of-Check Time-of-Use (TOCTOU) race condition vulnerability that allows a local low-privileged attacker to potentially access unauthorized resources. This affects Dell PowerEdge servers with AMD-based BIOS. Attackers must already have local access to the system.
💻 Affected Systems
- Dell PowerEdge Servers with AMD-based BIOS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation to gain unauthorized access to BIOS-level resources or sensitive system information
Likely Case
Limited information disclosure or unauthorized access to specific BIOS resources by authenticated low-privileged users
If Mitigated
No impact if proper access controls and patching are implemented
🎯 Exploit Status
Exploitation requires local access and race condition timing. No public exploits known at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: BIOS updates specified in DSA-2024-039
Vendor Advisory: https://www.dell.com/support/kbdoc/en-us/000226253/dsa-2024-039-security-update-for-dell-amd-based-poweredge-server-vulnerability
Restart Required: Yes
Instructions:
1. Identify your PowerEdge server model and current BIOS version. 2. Download appropriate BIOS update from Dell Support site. 3. Apply BIOS update following Dell's update procedures. 4. Reboot server to complete installation.
🔧 Temporary Workarounds
Restrict Local Access
allLimit physical and remote local access to PowerEdge servers to trusted administrators only
Implement Least Privilege
allEnsure users only have necessary permissions and cannot execute arbitrary code locally
🧯 If You Can't Patch
- Implement strict access controls to limit who can log into affected servers locally
- Monitor for suspicious local activity and BIOS access attempts
🔍 How to Verify
Check if Vulnerable:
Check BIOS version against Dell's advisory. Use iDRAC or OS commands to check current BIOS version.Check Version:
On Linux: 'dmidecode -s bios-version'. On Windows: 'wmic bios get smbiosbiosversion'. Via iDRAC: Check BIOS version in System Information.Verify Fix Applied:
Verify BIOS version has been updated to patched version specified in Dell advisory📡 Detection & Monitoring
Log Indicators:
- Unusual BIOS access attempts
- Multiple rapid BIOS function calls
- Failed privilege escalation attempts
Network Indicators:
- N/A - Local vulnerability only
SIEM Query:
Search for multiple BIOS-related access attempts from non-admin users within short time windows