Is CVE-2024-38304 in the CISA KEV catalog?

No. CVE-2024-38304 is not currently on the CISA Known Exploited Vulnerabilities list.

What is the CVSS severity of CVE-2024-38304?

CVE-2024-38304 has a CVSS v3 base score of 3.8 (LOW).

What is the EPSS score for CVE-2024-38304?

CVE-2024-38304 has an EPSS score of 0.15% (5th percentile), estimating the probability of exploitation in the next 30 days.

How do I fix CVE-2024-38304?

Upgrade dss 8440 firmware to 2.22.2 or later. Fixes are available for 31 affected products.

CVE & CISA-KEV Catalog

CVE-2024-38304

LOW

3.8

CVSS v3

NVD

Description

Dell PowerEdge Platform, 14G Intel BIOS version(s) prior to 2.22.x, contains an Access of Memory Location After End of Buffer vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.

CWE-788

How to fix

Remediation Available

dss 8440 firmwareNVD

Affected:< 2.22.2Fixed in:2.22.2CVE-2024-38304derived from NVD

emc storage nx3240 firmwareNVD

Affected:< 2.22.2Fixed in:2.22.2CVE-2024-38304derived from NVD

emc storage nx3340 firmwareNVD

Affected:< 2.22.2Fixed in:2.22.2CVE-2024-38304derived from NVD

emc xc core 6420 system firmwareNVD

Affected:< 2.22.2Fixed in:2.22.2CVE-2024-38304derived from NVD

emc xc core xc640 system firmwareNVD

Affected:< 2.22.2Fixed in:2.22.2CVE-2024-38304derived from NVD

emc xc core xc740xd2 firmwareNVD

Affected:< 2.22.1Fixed in:2.22.1CVE-2024-38304derived from NVD

emc xc core xc740xd system firmwareNVD

Affected:< 2.22.2Fixed in:2.22.2CVE-2024-38304derived from NVD

emc xc core xc940 system firmwareNVD

Affected:< 2.22.2Fixed in:2.22.2CVE-2024-38304derived from NVD

emc xc core xcxr2 firmwareNVD

Affected:< 2.22.1Fixed in:2.22.1CVE-2024-38304derived from NVD

poweredge c4140 firmwareNVD

Affected:< 2.22.2Fixed in:2.22.2CVE-2024-38304derived from NVD

poweredge c6420 firmwareNVD

Affected:< 2.22.2Fixed in:2.22.2CVE-2024-38304derived from NVD

poweredge fc640 firmwareNVD

Affected:< 2.22.2Fixed in:2.22.2CVE-2024-38304derived from NVD

poweredge m640 \(for pe vrtx\) firmwareNVD

Affected:< 2.22.2Fixed in:2.22.2CVE-2024-38304derived from NVD

poweredge m640 firmwareNVD

Affected:< 2.22.2Fixed in:2.22.2CVE-2024-38304derived from NVD

poweredge mx740c firmwareNVD

Affected:< 2.22.1Fixed in:2.22.1CVE-2024-38304derived from NVD

poweredge mx840c firmwareNVD

Affected:< 2.22.1Fixed in:2.22.1CVE-2024-38304derived from NVD

poweredge r440 firmwareNVD

Affected:< 2.22.1Fixed in:2.22.1CVE-2024-38304derived from NVD

poweredge r540 firmwareNVD

Affected:< 2.22.1Fixed in:2.22.1CVE-2024-38304derived from NVD

poweredge r640 firmwareNVD

Affected:< 2.22.2Fixed in:2.22.2CVE-2024-38304derived from NVD

poweredge r740 firmwareNVD

Affected:< 2.22.2Fixed in:2.22.2CVE-2024-38304derived from NVD

poweredge r740xd2 firmwareNVD

Affected:< 2.22.1Fixed in:2.22.1CVE-2024-38304derived from NVD

poweredge r740xd firmwareNVD

Affected:< 2.22.2Fixed in:2.22.2CVE-2024-38304derived from NVD

poweredge r840 firmwareNVD

Affected:< 2.22.1Fixed in:2.22.1CVE-2024-38304derived from NVD

poweredge r940 firmwareNVD

Affected:< 2.22.2Fixed in:2.22.2CVE-2024-38304derived from NVD

poweredge r940xa firmwareNVD

Affected:< 2.22.1Fixed in:2.22.1CVE-2024-38304derived from NVD

poweredge t440 firmwareNVD

Affected:< 2.22.1Fixed in:2.22.1CVE-2024-38304derived from NVD

poweredge t640 firmwareNVD

Affected:< 2.22.1Fixed in:2.22.1CVE-2024-38304derived from NVD

poweredge xe2420 firmwareNVD

Affected:< 2.22.2Fixed in:2.22.2CVE-2024-38304derived from NVD

poweredge xe7420 firmwareNVD

Affected:< 2.22.2Fixed in:2.22.2CVE-2024-38304derived from NVD

poweredge xe7440 firmwareNVD

Affected:< 2.22.2Fixed in:2.22.2CVE-2024-38304derived from NVD

poweredge xr2 firmwareNVD

Affected:< 2.22.1Fixed in:2.22.1CVE-2024-38304derived from NVD

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorLocal

Attack ComplexityLow

Privileges RequiredLow

User InteractionNone

ScopeChanged

Impact

ConfidentialityLow

IntegrityNone

AvailabilityNone

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Exploit Intelligence

0.15%probability of exploitation in 30 days

5thpercentile

Low risk: more likely to be exploited than 5% of all known CVEs.

References

Vendor Advisory1

dell.com

Embed a live status badge for CVE-2024-38304

Markdown

[![CVE-2024-38304](https://tridentstack.com/cve/badge/CVE-2024-38304.svg)](https://tridentstack.com/cve/CVE-2024-38304)

HTML

<a href="https://tridentstack.com/cve/CVE-2024-38304"><img src="https://tridentstack.com/cve/badge/CVE-2024-38304.svg" alt="CVE-2024-38304"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

Start free

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2024-12-20.