CVE-2024-29172
Dell Bsafe Ssl-J ≤ 6.6
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2024-29172 is a medium-severity Deadlock (CWE-833) vulnerability in Dell Bsafe Ssl-J. Its CVSS base score is 5.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 36th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2024-29172 is a deadlock vulnerability (CWE-833, CWE-667) in Dell BSAFE SSL-J, affecting versions prior to 6.6 and versions 7.0 through 7.2. Published on 2025-02-12, it carries a CVSS v3.1 base score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). The flaw allows a remote attacker to potentially trigger a denial of service condition.
A remote, unauthenticated attacker with network access can exploit this vulnerability to cause a deadlock, resulting in denial of service. Exploitation requires high attack complexity and does not involve user interaction or privileges, with impact limited to availability.
Dell's security advisory DSA-2024-221 details a security update for Dell BSAFE SSL-J addressing this and multiple other vulnerabilities. Practitioners should consult the advisory at https://www.dell.com/support/kbdoc/en-us/000226620/dsa-2024-221-security-update-for-dell-bsafe-ssl-j-multiple-vulnerabilities for patching instructions and mitigation guidance.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-26205
Vulnerability Data
Dell BSAFE SSL-J, versions prior to 6.6 and versions 7.0 through 7.2, contains a deadlock vulnerability. A remote attacker could potentially exploit this vulnerability, leading to a Denial of Service.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V15.4.3
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation activities can exercise concurrent paths and resource contention to discover deadlock conditions before deployment.
Security engineering principles applied during design can incorporate synchronization ordering, timeouts, and resource hierarchies that structurally avoid deadlock formation.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly include code reviews, static analysis, and concurrency standards that prevent improper locking.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect deadlock conditions through stress and concurrency testing.
Secure development lifecycle requires deadlock analysis and avoidance techniques during design and coding.
Application security requirements can mandate proper lock acquisition/release patterns.
Secure system architecture principles include concurrency controls and resource-locking discipline that prevent deadlock.
Secure coding standards mandate safe lock ordering, timeouts, and deadlock detection patterns.
Change management may catch locking issues introduced by modifications but does not prevent the weakness itself.