cnvd - cnvd-2021-94886

cnvd-2021-94886

Vulnerability from cnvd

Title: Dell BIOS信任管理问题漏洞

Description:

BIOS是一个首字母缩写，代表Basic Input Output System（基本输入输出系统）。也称为“系统设置”，BIOS 是计算机主板上小型存储器芯片内的嵌入式软件。此芯片称为互补式金属氧化物半导体 (CMOS)。它充当计算机硬件和操作系统之间的接口，允许软件控制硬件。

Dell BIOS 存在信任管理问题漏洞。本地攻击者可利用该漏洞通过管理界面在系统上设置BIOS管理员密码，访问硬盘存储上的敏感信息。

Severity: 低

Patch Name: Dell BIOS信任管理问题漏洞的补丁

Patch Description:

Dell BIOS 存在信任管理问题漏洞。本地攻击者可利用该漏洞通过管理界面在系统上设置BIOS管理员密码，访问硬盘存储上的敏感信息。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://www.dell.com/support/kbdoc/zh-cn/printview/000191495/10/en

Reference: https://nvd.nist.gov/vuln/detail/CVE-2021-21522

Impacted products

Name
Dell BIOS

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-21522",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2021-21522"
    }
  },
  "description": "BIOS\u662f\u4e00\u4e2a\u9996\u5b57\u6bcd\u7f29\u5199\uff0c\u4ee3\u8868Basic Input Output System\uff08\u57fa\u672c\u8f93\u5165\u8f93\u51fa\u7cfb\u7edf\uff09\u3002\u4e5f\u79f0\u4e3a\u201c\u7cfb\u7edf\u8bbe\u7f6e\u201d\uff0cBIOS \u662f\u8ba1\u7b97\u673a\u4e3b\u677f\u4e0a\u5c0f\u578b\u5b58\u50a8\u5668\u82af\u7247\u5185\u7684\u5d4c\u5165\u5f0f\u8f6f\u4ef6\u3002\u6b64\u82af\u7247\u79f0\u4e3a\u4e92\u8865\u5f0f\u91d1\u5c5e\u6c27\u5316\u7269\u534a\u5bfc\u4f53 (CMOS)\u3002\u5b83\u5145\u5f53\u8ba1\u7b97\u673a\u786c\u4ef6\u548c\u64cd\u4f5c\u7cfb\u7edf\u4e4b\u95f4\u7684\u63a5\u53e3\uff0c\u5141\u8bb8\u8f6f\u4ef6\u63a7\u5236\u786c\u4ef6\u3002\n\nDell BIOS \u5b58\u5728\u4fe1\u4efb\u7ba1\u7406\u95ee\u9898\u6f0f\u6d1e\u3002\u672c\u5730\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u7ba1\u7406\u754c\u9762\u5728\u7cfb\u7edf\u4e0a\u8bbe\u7f6eBIOS\u7ba1\u7406\u5458\u5bc6\u7801\uff0c\u8bbf\u95ee\u786c\u76d8\u5b58\u50a8\u4e0a\u7684\u654f\u611f\u4fe1\u606f\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://www.dell.com/support/kbdoc/zh-cn/printview/000191495/10/en",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-94886",
  "openTime": "2021-12-07",
  "patchDescription": "BIOS\u662f\u4e00\u4e2a\u9996\u5b57\u6bcd\u7f29\u5199\uff0c\u4ee3\u8868Basic Input Output System\uff08\u57fa\u672c\u8f93\u5165\u8f93\u51fa\u7cfb\u7edf\uff09\u3002\u4e5f\u79f0\u4e3a\u201c\u7cfb\u7edf\u8bbe\u7f6e\u201d\uff0cBIOS \u662f\u8ba1\u7b97\u673a\u4e3b\u677f\u4e0a\u5c0f\u578b\u5b58\u50a8\u5668\u82af\u7247\u5185\u7684\u5d4c\u5165\u5f0f\u8f6f\u4ef6\u3002\u6b64\u82af\u7247\u79f0\u4e3a\u4e92\u8865\u5f0f\u91d1\u5c5e\u6c27\u5316\u7269\u534a\u5bfc\u4f53 (CMOS)\u3002\u5b83\u5145\u5f53\u8ba1\u7b97\u673a\u786c\u4ef6\u548c\u64cd\u4f5c\u7cfb\u7edf\u4e4b\u95f4\u7684\u63a5\u53e3\uff0c\u5141\u8bb8\u8f6f\u4ef6\u63a7\u5236\u786c\u4ef6\u3002\r\n\r\nDell BIOS \u5b58\u5728\u4fe1\u4efb\u7ba1\u7406\u95ee\u9898\u6f0f\u6d1e\u3002\u672c\u5730\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u7ba1\u7406\u754c\u9762\u5728\u7cfb\u7edf\u4e0a\u8bbe\u7f6eBIOS\u7ba1\u7406\u5458\u5bc6\u7801\uff0c\u8bbf\u95ee\u786c\u76d8\u5b58\u50a8\u4e0a\u7684\u654f\u611f\u4fe1\u606f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Dell BIOS\u4fe1\u4efb\u7ba1\u7406\u95ee\u9898\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Dell BIOS"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2021-21522",
  "serverity": "\u4f4e",
  "submitTime": "2021-09-29",
  "title": "Dell BIOS\u4fe1\u4efb\u7ba1\u7406\u95ee\u9898\u6f0f\u6d1e"
}

CVE-2021-21522 (GCVE-0-2021-21522)

Vulnerability from cvelistv5

Published

2021-09-28 19:20

Modified

2024-09-17 03:23

Severity ?

8.2 (High) - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-255 - Credentials Management

Summary

Dell BIOS contains a Credentials Management issue. A local authenticated malicious user may potentially exploit this vulnerability to gain access to sensitive information on an NVMe storage by resetting the BIOS password on the system via the Manageability Interface.

References

▼	URL	Tags
	https://www.dell.com/support/kbdoc/000191495	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	Dell	CPG BIOS	Version: unspecified < 1.13.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T18:16:23.008Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.dell.com/support/kbdoc/000191495"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "CPG BIOS",
          "vendor": "Dell",
          "versions": [
            {
              "lessThan": "1.13.0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2021-09-16T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Dell BIOS contains a Credentials Management issue. A local authenticated malicious user may potentially exploit this vulnerability to gain access to sensitive information on an NVMe storage by resetting the BIOS password on the system via the Manageability Interface."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-255",
              "description": "CWE-255: Credentials Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-09-28T19:20:18",
        "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
        "shortName": "dell"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.dell.com/support/kbdoc/000191495"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@dell.com",
          "DATE_PUBLIC": "2021-09-16",
          "ID": "CVE-2021-21522",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "CPG BIOS",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "1.13.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Dell"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Dell BIOS contains a Credentials Management issue. A local authenticated malicious user may potentially exploit this vulnerability to gain access to sensitive information on an NVMe storage by resetting the BIOS password on the system via the Manageability Interface."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": 8.2,
            "baseSeverity": "High",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-255: Credentials Management"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.dell.com/support/kbdoc/000191495",
              "refsource": "MISC",
              "url": "https://www.dell.com/support/kbdoc/000191495"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
    "assignerShortName": "dell",
    "cveId": "CVE-2021-21522",
    "datePublished": "2021-09-28T19:20:18.180798Z",
    "dateReserved": "2021-01-04T00:00:00",
    "dateUpdated": "2024-09-17T03:23:12.635Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted