Dell PowerEdge Server BIOS / Precision Rack BIOS (improper privilege management): An unauthenticated local attacker

CVE-2024-0172Firmware, BMC & network fabriccurated

Impact

An unauthenticated local attacker escalates privilege with scope change - a firmware-level escalation that survives OS reinstall and is invisible to host-based tooling.

Who can reach it

Local access to the server. On bare-metal GPU rental this is the tenant themselves.

What to do

Flash the fixed PowerEdge BIOS. A BIOS update is a cold reboot per node and cannot be done live - on a GPU fleet that means draining jobs and taking the box out of the scheduler, so batch it with other firmware work rather than doing a standalone pass.

References

https://www.dell.com/support/kbdoc/en-us/000223727/dsa-2024-035-security-update-for-dell-poweredge-server-bios-for-an-improper-privilege-management-security-vulnerability

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.