TPM Invisible BIOS Vulnerability Affects Dell, Alienware Machines

A circuit board with Dell printed on it
(Image credit: Photo by Pok Rie from Pexels)

Five new BIOS security weaknesses have been discovered in the BIOS used by Dell in many of its Alienware, Inspiron and Latitude products. The vulnerabilities, collated by The Hacker News and partly discovered by security firm Binarly (opens in new tab), could allow an attacker to execute potentially damaging code.

Alienware m17 Deals cover

(Image credit: Alienware)

Tracked as CVE-2022-24415, CVE-2022-24416, CVE-2022-24419, CVE-2022-24420, and CVE-2022-24421, the highest severity level is 8.2, or High, on the National Vulnerability Database’s scale.

Models with the vulnerability include Alienware 13, 15 and 17 laptops, Edge Gateway 3000 and 5000 servers, Inspiron laptops and all-in-ones, Vostro laptops and desktops, Embedded Box PCs 3000 and 5000, the Wyse 7040 Thin Client, and XPS 8930 desktops. A complete list is available from the Dell support website (opens in new tab), along with links to firmware updates.

The exploits all take advantage of the x86 microcontroller’s System Management Mode, which usually looks after things like power management and temperature. Its code, which is usually proprietary and manufacturer-developed, runs at the highest privilege level and is invisible to both the operating system and the TPM chip, if installed. This makes it ripe for exploitation, and can be used to deploy a firmware-based rootkit. However, it’s worth noting that a malicious user has to be locally authenticated to begin the attack, meaning physical access to the PC is required.

The BIOS, as Binarly explains (opens in new tab), is a complex thing, and it’s difficult to close all the holes that could be used for an attack: "These failures are a direct consequence of the complexity of the codebase or support for legacy components that get less security attention, but are still widely deployed in the field. In many cases, the same vulnerability can be fixed over multiple iterations, and still, the complexity of the attack surface leaves open gaps for malicious exploitation.

“The majority of enterprise tools available for source code analysis are not suitable for pinpointing firmware-specific security defects,” Binarly continues. “There are multiple reasons, one of the most obvious being the differences in implementations of the memory management functions compared to the non-firmware-specific software. This leads to a false sense of security when no vulnerabilities are detected at source code level.”

Dell recommends downloading a BIOS update for affected computers immediately. Binarly commended Dell for its fast response to the situation, writing: “It took about three months from the issue reporting to the patch release, when the usual timeline with other vendors is close to six months.” 

Ian Evenden
Freelance News Writer

Ian Evenden is a UK-based news writer for Tom’s Hardware US. He’ll write about anything, but stories about Raspberry Pi and DIY robots seem to find their way to him.

  • Makaveli
    I hope dell is emailing all their customers since people that buy prebuilt computers are usually not to tech savy.
    Reply
  • Heat_Fan89
    So you need physical access to the PC.?Is this just FUD or am I missing something? I do own a P.O.S. Alienware R10 desktop because of the GPU shortage and I won't update the BIOS for this. Dell doesn't have a good track record regarding BIOS updates.
    Reply