CVE-2024-29172
Published: 12 February 2025
Summary
CVE-2024-29172 is a medium-severity Deadlock (CWE-833) vulnerability in Dell Bsafe Ssl-J. Its CVSS base score is 5.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 47.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-29172 is a deadlock vulnerability (CWE-833, CWE-667) in Dell BSAFE SSL-J, affecting versions prior to 6.6 and versions 7.0 through 7.2. Published on 2025-02-12, it carries a CVSS v3.1 base score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). The flaw allows a remote attacker to potentially trigger a denial of service condition.
A remote, unauthenticated attacker with network access can exploit this vulnerability to cause a deadlock, resulting in denial of service. Exploitation requires high attack complexity and does not involve user interaction or privileges, with impact limited to availability.
Dell's security advisory DSA-2024-221 details a security update for Dell BSAFE SSL-J addressing this and multiple other vulnerabilities. Practitioners should consult the advisory at https://www.dell.com/support/kbdoc/en-us/000226620/dsa-2024-221-security-update-for-dell-bsafe-ssl-j-multiple-vulnerabilities for patching instructions and mitigation guidance.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-26205
Vulnerability details
Dell BSAFE SSL-J, versions prior to 6.6 and versions 7.0 through 7.2, contains a deadlock vulnerability. A remote attacker could potentially exploit this vulnerability, leading to a Denial of Service.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The deadlock vulnerability in the SSL library directly enables remote exploitation causing application/system denial of service via crafted network input.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires identification, reporting, and timely correction of the specific deadlock flaw in Dell BSAFE SSL-J versions, preventing exploitation via patching as detailed in Dell's advisory.
Implements denial-of-service protections at system entry and exit points to block remote attackers from triggering the deadlock vulnerability.
Protects resource availability through priority allocation and mechanisms that mitigate the impact of deadlock-induced denial of service.