CVE-2021-21556

Vulnerability

A stack-based buffer overflow vulnerability exists in the BIOS of Dell PowerEdge R640, R740, R740XD, R840, R940, R940xa, MX740c, MX840c, and T640 servers when NVDIMM-N modules are installed. This flaw can be triggered in the UEFI or BIOS Preboot Environment, potentially allowing a local attacker with high privileges to exploit it.

Exploitation

To exploit this vulnerability, an attacker must have local access with high privileges (e.g., root or administrator). The attacker would need to craft input that triggers the buffer overflow during the preboot phase. No user interaction beyond the initial access is required, but the attacker must be able to influence memory operations during boot.

Impact

Successful exploitation could lead to denial of service, arbitrary code execution, or information disclosure within the UEFI or BIOS environment. This could compromise system integrity, confidentiality, and availability at a low-level firmware stage, potentially persisting across reboots.

Mitigation

Dell has released BIOS updates as part of DSA-2021-103 to address this vulnerability [1]. Affected users should apply the latest BIOS update from Dell's support site for their specific server model. No workarounds are available; updating the BIOS is the only complete mitigation.