CVE-2023-22616

Опубликовано: 12 апр. 2023

Источник: nvd

CVSS3: 7.8

EPSS Низкий

Описание

An issue was discovered in Insyde InsydeH2O with kernel 5.2 through 5.5. The Save State register is not checked before use. The IhisiSmm driver does not check the value of a save state register before use. Due to insufficient input validation, an attacker can corrupt SMRAM.

Ссылки

https://research.nccgroup.com/2023/04/11/stepping-insyde-system-management-mode/
Exploit
Third Party Advisory
https://www.insyde.com/security-pledge
Vendor Advisory
https://www.insyde.com/security-pledge/SA-2023022
Vendor Advisory
https://research.nccgroup.com/2023/04/11/stepping-insyde-system-management-mode/
Exploit
Third Party Advisory
https://www.insyde.com/security-pledge
Vendor Advisory
https://www.insyde.com/security-pledge/SA-2023022
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*

Версия от 5.2 (включая) до 5.5 (включая)

EPSS

Процентиль: 22%

0.00071

Низкий

7.8 High

CVSS3

Дефекты

CWE-610

Связанные уязвимости

GHSA-f9jq-jhvv-4xmw