CVE-2024-0172: Dell PowerEdge R660 Privilege Escalation

CVE-2024-0172 Overview

CVE-2024-0172 is an improper privilege management vulnerability affecting Dell PowerEdge Server BIOS and Dell Precision Rack BIOS. This BIOS-level security flaw enables an unauthenticated local attacker to exploit improper privilege management controls, potentially leading to privilege escalation on affected systems. Given the firmware-level nature of this vulnerability, successful exploitation could allow attackers to gain elevated privileges and potentially compromise the entire server infrastructure.

Critical Impact

Local attackers can exploit this BIOS vulnerability to escalate privileges, potentially gaining administrative control over affected Dell PowerEdge and Precision Rack servers. This represents a significant risk for enterprise data centers and cloud infrastructure.

Affected Products

• Dell PowerEdge R660, R760, R860, R960 Series (and firmware)
• Dell PowerEdge R650, R750, R750xa, R740, R740xd, R640, R940 Series (and firmware)
• Dell PowerEdge T560, T550, T640, T440, T350, T150, T140, T340 Series (and firmware)
• Dell PowerEdge XE9680, XE8640, XE9640, XE8545, XE2420, XE7420, XE7440 Series (and firmware)
• Dell PowerEdge MX760c, MX750c, MX740c, MX840c Series (and firmware)
• Dell PowerEdge C6620, C6520, C6525, C6420, C4140 Series (and firmware)
• Dell EMC Storage NX3240, NX3340, NX440 (and firmware)
• Dell EMC XC Core Systems (XC450, XC650, XC750, XC750xa, XC6520, XC640, XC740xd, XC940, XCXR2, XC7525)
• Dell DSS 8440 (and firmware)

Discovery Timeline

• April 3, 2024 - CVE-2024-0172 published to NVD
• February 4, 2025 - Last updated in NVD database

Technical Details for CVE-2024-0172

Vulnerability Analysis

This vulnerability exists within the BIOS firmware of Dell PowerEdge Server and Dell Precision Rack systems. The improper privilege management flaw (CWE-269) allows local attackers without authentication to bypass privilege controls that should restrict access to sensitive BIOS functions and configurations. The attack requires local access to the system but does not require any user interaction, making it exploitable in scenarios where attackers have physical or local console access to vulnerable servers.

The vulnerability affects high-confidentiality, high-integrity, and high-availability functions within the BIOS environment. Successful exploitation could allow an attacker to modify BIOS settings, disable security features, install persistent malware at the firmware level, or gain complete control over the underlying hardware platform.

Root Cause

The root cause of CVE-2024-0172 stems from improper privilege management controls within the Dell PowerEdge and Precision Rack BIOS firmware. The vulnerability is classified under CWE-269 (Improper Privilege Management), indicating that the BIOS fails to properly enforce privilege separation or access controls for certain operations. This allows unprivileged local users to perform actions that should be restricted to administrators or the system itself.

BIOS-level vulnerabilities are particularly concerning because they operate below the operating system layer, making them difficult to detect and potentially allowing attackers to persist even through OS reinstallation or disk formatting.

Attack Vector

The attack vector for CVE-2024-0172 is local, meaning an attacker must have local access to the affected system. The exploitation scenario involves:

1. An attacker gains local access to a vulnerable Dell PowerEdge or Precision Rack server (physical access, remote console, or through another compromised service)
2. The attacker exploits the improper privilege management flaw in the BIOS without requiring authentication
3. The privilege escalation occurs at the firmware level, potentially granting the attacker administrative or system-level control
4. The attacker can then modify BIOS configurations, disable security features, or establish persistent access

Due to the firmware-level nature of this vulnerability, the technical details of exploitation are not publicly documented. Organizations should consult the Dell Security Advisory DSA-2024-035 for specific remediation guidance.

Detection Methods for CVE-2024-0172

Indicators of Compromise

• Unexpected changes to BIOS configurations or settings without administrative approval
• Unauthorized modifications to boot order, secure boot settings, or BIOS passwords
• Anomalous system behavior during POST (Power-On Self-Test) or boot sequences
• Evidence of unauthorized local access attempts or suspicious console sessions

Detection Strategies

• Implement BIOS integrity monitoring to detect unauthorized firmware modifications
• Enable and regularly review iDRAC (Integrated Dell Remote Access Controller) logs for suspicious BIOS access or configuration changes
• Deploy endpoint detection and response (EDR) solutions capable of monitoring firmware-level activities
• Conduct regular BIOS version audits against Dell's published secure firmware versions

Monitoring Recommendations

• Configure alerts for any BIOS configuration changes through Dell OpenManage or similar management tools
• Monitor for unauthorized physical or remote console access to server systems
• Implement hardware security module (HSM) logging where available to track firmware access
• Establish baseline BIOS configurations and alert on deviations

How to Mitigate CVE-2024-0172

Immediate Actions Required

• Identify all affected Dell PowerEdge and Precision Rack servers within your environment using asset inventory tools
• Prioritize patching for systems in high-security environments or those accessible to multiple users
• Restrict physical and remote console access to affected systems until patches are applied
• Enable BIOS password protection if not already configured to add an additional layer of access control

Patch Information

Dell has released BIOS updates to address this vulnerability. Administrators should obtain the latest BIOS firmware from the Dell Security Advisory DSA-2024-035, which provides model-specific firmware versions and installation instructions. BIOS updates should be applied during scheduled maintenance windows as they typically require system reboots.

Workarounds

• Implement strict physical access controls to limit who can interact with server consoles
• Disable unnecessary remote access services (e.g., iDRAC virtual console) until patches are applied
• Enable Secure Boot if supported and not already configured to prevent unauthorized code execution during boot
• Implement network segmentation to isolate management interfaces from general network access

# Example: Check current BIOS version using Dell RACADM (iDRAC)
racadm getversion -l | grep BIOS

# Example: Configure iDRAC to restrict console access
racadm set iDRAC.VirtualConsole.Enabled 0

# Example: Enable BIOS password via iDRAC (consult Dell documentation for your model)
racadm set BIOS.SysSecurity.SetupPassword <password>