Have a Dell desktop or laptop? You should upgrade your firmware now

Cloud security company Eclypsium has revealed that Dell desktops, laptops and tablets have multiple vulnerabilities. Seems like we finally know why LVFS (Linux Vendor Firmware Service) had a huge spike in activity recently, with it supplying over 100,000 firmware updates in a single day as shown by developer Richard Hughes on Twitter.

Even with Secure Boot enabled it seems it doesn't really help and affects at least 129 different models of Dell laptops, tablets, and desktops. Eclypsium estimate around 30 million devices will be affected by this. It doesn't specifically state it's an issue for Linux and does mention Windows explicitly but the point is the same, you'll be vulnerable if you don't ensure you're up to date. The series of issues allows a "privileged network attacker to gain arbitrary code execution within the BIOS of vulnerable machines".

If you do have a Dell device, it would be worth ensuring you've run all updates and checked for the latest firmware. You can do firmware upgrades on Linux with services provided by LVFS. You can run updates using this command in terminal:

sudo fwupdmgr update

Most distributions should have an up to date GNOME Software or KDE Discover that support it too, so you can use those if you prefer.

See more in the announcement from Eclypsium and also from Dell directly.