CVE-2023-28075: dell alienware_m15_r7_firmware

Vulnerability summary

CVE-2023-28075 is a medium (CVSS 6.9) vulnerability in dell alienware_m15_r7_firmware. EPSS estimates a 0.19% chance of exploitation in the next 30 days, higher than 7.8% of scored vulnerabilities.

Timeline

1. 16-08-2023
   PublishedVulnerability first disclosed.
2. 08-10-2024
   Last modifiedVulnerability information updated.

Description

Dell BIOS contain a Time-of-check Time-of-use vulnerability in BIOS. A local authenticated malicious user with physical access to the system could potentially exploit this vulnerability by using a specifically timed DMA transaction during an SMI in order to gain arbitrary code execution on the system.

• CWE-367Time-of-check Time-of-use (TOCTOU) Race ConditionThe product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.