CVE-2023-22614

Опубликовано: 11 апр. 2023

Источник: nvd

CVSS3: 8.8

EPSS Низкий

Описание

An issue was discovered in ChipsetSvcSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. There is insufficient input validation in BIOS Guard updates. An attacker can induce memory corruption in SMM by supplying malformed inputs to the BIOS Guard SMI handler.

Ссылки

https://research.nccgroup.com/2023/04/11/stepping-insyde-system-management-mode/
Exploit
Third Party Advisory
https://www.insyde.com/security-pledge
Vendor Advisory
https://www.insyde.com/security-pledge/SA-2023020
Vendor Advisory
https://research.nccgroup.com/2023/04/11/stepping-insyde-system-management-mode/
Exploit
Third Party Advisory
https://www.insyde.com/security-pledge
Vendor Advisory
https://www.insyde.com/security-pledge/SA-2023020
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:insyde:insydeh2o:05.42.52.0026:*:*:*:*:*:*:*

cpe:2.3:a:insyde:insydeh2o:05.43.01.0026:*:*:*:*:*:*:*

cpe:2.3:a:insyde:insydeh2o:05.43.12.0056:*:*:*:*:*:*:*

cpe:2.3:a:insyde:insydeh2o:05.44.34.0054:*:*:*:*:*:*:*

cpe:2.3:a:insyde:insydeh2o:05.44.45.0015:*:*:*:*:*:*:*

cpe:2.3:a:insyde:insydeh2o:05.44.45.0028:*:*:*:*:*:*:*

EPSS

Процентиль: 40%

0.00179

Низкий

8.8 High

CVSS3

Дефекты

CWE-787

Связанные уязвимости

GHSA-7x7c-2rvc-69fh

CVSS3: 8.8

github

почти 3 года назад

BDU:2023-02230

CVSS3: 7.9

fstec