Denial of Service Vulnerability in Dell BSAFE

Dell has identified a vulnerability in its BSAFE Micro Edition Suite and BSAFE SSL-J cryptographic software libraries, tracked as CVE-2024-38640. The flaw resides within the product implementation and can be exploited by an unauthenticated remote attacker. By sending specifically crafted packets to an application or service that utilizes the vulnerable BSAFE libraries, an attacker can induce a state that results in a Denial of Service (DoS). This prevents the affected service from processing further requests or maintaining availability for legitimate users. Because BSAFE is a core cryptographic library, its impact extends to any software package that bundles or statically links against these specific versions. Defenders should prioritize identifying software within their environment that utilizes these BSAFE components and apply available patches or vendor-provided updates to mitigate the risk of service disruption.

Impact

The successful exploitation of CVE-2024-38640 results in a Denial of Service, causing the impacted application or service to crash or become unresponsive. Organizations utilizing products that embed BSAFE libraries are at risk of operational downtime. There is currently no report of remote code execution or data exfiltration associated with this specific DoS vulnerability.

Recommendation

Prioritized actions for security and IT teams:

• Identify all instances of software in the environment using BSAFE Micro Edition Suite or BSAFE SSL-J.
• Review vendor-specific security advisories from Dell for the list of updated library versions that address CVE-2024-38640.
• Apply the vendor-provided patches or software updates as soon as they are made available by the affected software providers.
• If immediate patching is not possible, implement network-level controls to restrict access to services utilizing the vulnerable BSAFE libraries to trusted management segments.