CVE-2019-18579

Current Description

Settings for the Dell XPS 13 2-in-1 (7390) BIOS versions prior to 1.1.3 contain a configuration vulnerability. The BIOS configuration for the "Enable Thunderbolt (and PCIe behind TBT) pre-boot modules" setting is enabled by default. A local unauthenticated attacker with physical access to a user's system can obtain read or write access to main memory via a DMA attack during platform boot.

Basic Data

Published	December 16, 2019
Last Modified	December 30, 2019
Assigner	cve@mitre.org
Data Type	CVE
Data Format	MITRE
Data Version	4.0
Problem Type	NVD-CWE-Other
CVE Data Version	4.0

Base Metric V2

CVSS 2 - Version	2.0
CVSS 2 - Vector String	AV:L/AC:L/Au:N/C:C/I:C/A:C
CVSS 2 - Access Vector	LOCAL
CVSS 2 - Access Complexity	LOW
CVSS 2 - Authentication	NONE
CVSS 2 - Confidentiality Impact	COMPLETE
CVSS 2 - Availability Impact	COMPLETE
CVSS 2 - Base Score	7.2
Severity	HIGH
Exploitability Score	3.9
Impact Score	10.0
Obtain All Privilege	false
Obtain User Privilege	false
Obtain Other Privilege	false

Base Metric V3

No data provided.

Configurations

AND

OR - Configuration 1

Cpe Version	Part	Vendor	Product	Version	Update	Edition	Language	SW Edition	Target SW	Target HW	Other	Version Start Including	Version End Including	Version Start Excluding	Version End Excluding
2.3	OS	Dell	Xps 7390 Firmware	*	*	*	*	*	*	*	*				1.1.3

OR Running on/with:

Cpe Version	Part	Vendor	Product	Version	Update	Edition	Language	SW Edition	Target SW	Target HW	Other	Version Start Including	Version End Including	Version Start Excluding	Version End Excluding
2.3	Hardware	Dell	Xps 7390	-	*	*	*	*	*	*	*

Vulnerable Software List

Vendor	Product	Versions
Dell	Xps 7390 Firmware	*

References

Name	Source	URL	Tags
https://www.dell.com/support/article/SLN319808	https://www.dell.com/support/article/SLN319808	MISC	Patch Vendor Advisory