Описание
An issue was discovered in StorageSecurityCommandDxe in Insyde InsydeH2O with Kernel 5.1 before 05.14.28, Kernel 5.2 before 05.24.28, and Kernel 5.3 before 05.32.25. An SMM callout vulnerability allows an attacker to hijack execution flow of code running in System Management Mode. Exploiting this issue could lead to escalating privileges to SMM.
Ссылки
- Third Party Advisory
- Third Party Advisory
- Vendor Advisory
- Vendor Advisory
- Third Party Advisory
- Third Party Advisory
- Vendor Advisory
- Vendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия от 5.1 (включая) до 5.14.34 (исключая)
cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*
Конфигурация 2Версия от 5.2 (включая) до 5.24.34 (исключая)
cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*
Конфигурация 3Версия от 5.3 (включая) до 5.24.34 (исключая)
cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*
EPSS
Процентиль: 23%
0.00075
Низкий
8.2 High
CVSS3
4.6 Medium
CVSS2
Дефекты
NVD-CWE-noinfo
Связанные уязвимости
CVSS3: 8.2
github
почти 4 года назад
SMM callout vulnerability allowing a possible attacker to hijack execution flow of a code running in System Management Mode. Exploiting this issue could lead to escalating privileges to SMM.
EPSS
Процентиль: 23%
0.00075
Низкий
8.2 High
CVSS3
4.6 Medium
CVSS2
Дефекты
NVD-CWE-noinfo