/
← Voltar ao feed
medium

Dock firmware patching gaps: Dell and Lenovo update-tool flaws, hardening settings that block updates, and DMA protection checks

1 fonte(s) · 1 atualização(ões) · publicado 17/10/2026 11:00 · coletado há 1 dia

Docking stations are easy to leave unpatched. A Dell support article (last modified May 22, 2026) says that with "Enable External USB Port" off and Type-C dock LAN on, the HD22Q, WD19 and WD22TB4 docks cannot be updated by Dell's Firmware Utility. Separately, the tools that update docks have had local vulnerabilities, including CVE-2023-43078 in Dell's update utility and CVE-2022-4569 in Lenovo's update tool. The article makes no claim of exploitation. It advises inventorying docks, piloting lockdown settings, and verifying DMA protection on hosts.

Technical Details

  • CVE-2023-43078 (DSA-2023-362): improper link resolution in the Dell firmware update utility for the WD19 and WD22TB4, leading to privilege escalation or denial of service. Fixed in firmware 01.00.36. Dell scores it 6.7 Medium and NVD scores it 7.3 High.
  • CVE-2022-4569: local privilege escalation in Lenovo's update tool for the ThinkPad Hybrid USB-C with USB-A dock (7.8 High).
  • CVE-2023-28396 (DSA-2024-014): improper access control in Intel Thunderbolt controller firmware, local attack vector, 6.1 Medium.
  • CVE-2025-36573 (DSA-2025-218): Dell Pro Smart Dock SD25 / SD25TB4 firmware before 01.00.08.01 writes sensitive information to a log file. Dell scores it 7.1 High and NVD 5.5 Medium.
  • All four have a local attack vector, so an attacker needs a foothold on the machine first.
  • Microsoft's USB4 guidance says a firmware option to disable PCIe tunneling can stop Thunderbolt 3 docks from enumerating.
  • Thunderbolt, USB4 and CFexpress are PCIe hot-plug interfaces. Without IOMMU protection they allow DMA attacks. Kernel DMA Protection does not cover boot, and its status can read OFF when VT-d is disabled in UEFI.
  • The earlier Thunderspy (2020) and Thunderclap (2019) research is cited as background. No claim is made about how either fares against Thunderbolt 4 hosts.
  • The SD25TB4 supports PXE boot, MAC Address Pass-Through and Wake-on-LAN, which matters for MAC-based device tracking.

Remediation

  • Inventory every dock with its model, connection type, firmware version and a named patch owner.
  • Pilot lockdown settings (external USB port, PCIe tunneling) on a few desks and confirm dock updates still run.
  • Patch the update tools as well as the dock firmware: Dell firmware 01.00.36 or later, SD25 firmware 01.00.08.01 or later, and the fixed Lenovo tool.
  • On Windows, check Memory access protection under Core isolation details or in msinfo32. If it shows OFF, enable Intel VT-x and VT-d in UEFI, and review the DmaGuard policy for incompatible devices.
  • Do not assume a Windows DMA policy maps onto Apple silicon, which uses a separate per-agent IOMMU design.

Linha do tempo

  1. gbhackers.com ↗ · pub. 17/10/2026 11:00 · coletado 19/10 17:54 primeiro registro

    Dock firmware patching gaps: Dell and Lenovo update-tool flaws, hardening settings that block updates, and DMA protection checks

    ler a análise desta fonte

    Docking stations are easy to leave unpatched. A Dell support article (last modified May 22, 2026) says that with "Enable External USB Port" off and Type-C dock LAN on, the HD22Q, WD19 and WD22TB4 docks cannot be updated by Dell's Firmware Utility. Separately, the tools that update docks have had local vulnerabilities, including CVE-2023-43078 in Dell's update utility and CVE-2022-4569 in Lenovo's update tool. The article makes no claim of exploitation. It advises inventorying docks, piloting lockdown settings, and verifying DMA protection on hosts.

    Technical Details

    • CVE-2023-43078 (DSA-2023-362): improper link resolution in the Dell firmware update utility for the WD19 and WD22TB4, leading to privilege escalation or denial of service. Fixed in firmware 01.00.36. Dell scores it 6.7 Medium and NVD scores it 7.3 High.
    • CVE-2022-4569: local privilege escalation in Lenovo's update tool for the ThinkPad Hybrid USB-C with USB-A dock (7.8 High).
    • CVE-2023-28396 (DSA-2024-014): improper access control in Intel Thunderbolt controller firmware, local attack vector, 6.1 Medium.
    • CVE-2025-36573 (DSA-2025-218): Dell Pro Smart Dock SD25 / SD25TB4 firmware before 01.00.08.01 writes sensitive information to a log file. Dell scores it 7.1 High and NVD 5.5 Medium.
    • All four have a local attack vector, so an attacker needs a foothold on the machine first.
    • Microsoft's USB4 guidance says a firmware option to disable PCIe tunneling can stop Thunderbolt 3 docks from enumerating.
    • Thunderbolt, USB4 and CFexpress are PCIe hot-plug interfaces. Without IOMMU protection they allow DMA attacks. Kernel DMA Protection does not cover boot, and its status can read OFF when VT-d is disabled in UEFI.
    • The earlier Thunderspy (2020) and Thunderclap (2019) research is cited as background. No claim is made about how either fares against Thunderbolt 4 hosts.
    • The SD25TB4 supports PXE boot, MAC Address Pass-Through and Wake-on-LAN, which matters for MAC-based device tracking.

    Remediation

    • Inventory every dock with its model, connection type, firmware version and a named patch owner.
    • Pilot lockdown settings (external USB port, PCIe tunneling) on a few desks and confirm dock updates still run.
    • Patch the update tools as well as the dock firmware: Dell firmware 01.00.36 or later, SD25 firmware 01.00.08.01 or later, and the fixed Lenovo tool.
    • On Windows, check Memory access protection under Core isolation details or in msinfo32. If it shows OFF, enable Intel VT-x and VT-d in UEFI, and review the DmaGuard policy for incompatible devices.
    • Do not assume a Windows DMA policy maps onto Apple silicon, which uses a separate per-agent IOMMU design.