Dell client and server BIOS - NVMe drive password (SED credential) defeated by resetting the BIOS password

Impact

The BIOS-managed NVMe drive password - the credential many operators rely on to keep a locked drive locked - can be defeated by resetting the BIOS password through the manageability interface, giving access to data on the NVMe device. The paired issue removes the limit on failed NVMe password attempts, so an administrator can brute-force the drive password instead. BREAKS TENANT HANDOFF wherever platform-level drive locking is your control: the lock lives in a BIOS that a local administrator can reset, so the drive credential inherits the security of the BIOS password rather than of the drive. This is the systems-integration failure mode of SEDs - the drive firmware may be perfectly sound while the platform that holds its credential hands it away.

Who can reach it

A local authenticated user with elevated privilege on the host - which on bare metal means the tenant you just rented the box to, if they have BIOS/manageability reach. The brute-force variant requires local administrator access.

What to do

Apply the Dell BIOS updates named in Dell's advisory for the affected client and PowerEdge platforms; this is a host BIOS flash, so it needs a reboot and a maintenance window per node but not a drive teardown. Then fix the design, not just the bug: do not use BIOS-held NVMe passwords as your tenant-separation mechanism on bare metal, because the whole scheme assumes the tenant cannot reach platform firmware, and on a rented bare-metal node that assumption is false by definition. Lock down the manageability interface, set and monitor BIOS admin passwords, and move the actual data protection to LUKS/dm-crypt with a key your control plane holds and destroys at reclaim - a key the tenant's BIOS access cannot reach.

References