Dell PowerEdge 14G Intel BIOS (improper input validation): A high-privileged local attacker extracts information

Impact

A high-privileged local attacker extracts information from the firmware layer with scope change - firmware-resident secrets and platform configuration leaking to the OS.

Who can reach it

Local high-privilege user on a 14G Intel PowerEdge.

What to do

Update 14G Intel BIOS to 2.22.x or later. Flash the fixed PowerEdge BIOS. A BIOS update is a cold reboot per node and cannot be done live - on a GPU fleet that means draining jobs and taking the box out of the scheduler, so batch it with other firmware work rather than doing a standalone pass.

References

Related entries

• Insyde InsydeH2O (IHISI function 0x49, UEFI variable factory reset): IHISI function 0x49 restores certain UEFICVE-2024-39707 · Insyde InsydeH2O (IHISI function 0x49, UEFI variable factory reset)Medium
• GRUB2 (HFS+ filesystem parser): A reference count can be decremented twice, producing a use-after-freeCVE-2024-45783 · GRUB2 (HFS+ filesystem parser)Medium
• AMD CPU - stale TLB entries in SEV-SNP guests: A silicon bug lets a local admin-privileged attacker run an SEV-SNPCVE-2025-29934 · AMD CPU - stale TLB entries in SEV-SNP guestsMedium
• Dell iDRAC Service Module (iSM, incorrect permissions): Incorrect permission assignment on a critical resource letsCVE-2025-38742 · Dell iDRAC Service Module (iSM, incorrect permissions)Medium
• AMD CPU microcode - bound check: An improper bound check inside AMD CPU microcode lets a malicious **guest** write intoCVE-2025-52534 · AMD CPU microcode - bound checkMedium
• AMD Secure Processor - privilege check on write path: The ASP accepts an input value and performs a writeCVE-2025-54511 · AMD Secure Processor - privilege check on write pathMedium