An issue SMM memory leak vulnerability in SMM driver (SMRAM was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An attacker can dump SMRAM contents via the software SMI provided by the FvbServicesRuntimeDxe driver to read the contents of SMRAM, leading to information disclosure.
References
| Link | Resource |
|---|---|
| https://binarly.io/advisories/BRLY-2022-025/index.html | Exploit Third Party Advisory |
| https://www.insyde.com/security-pledge | Vendor Advisory |
| https://www.insyde.com/security-pledge/SA-2022034 | Vendor Advisory |
Configurations
History
08 Aug 2023, 14:21
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-20 |
26 Sep 2022, 16:39
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Insyde insydeh2o
Insyde |
|
| CWE | CWE-119 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.0 |
| CPE | cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:* | |
| References | (MISC) https://www.insyde.com/security-pledge/SA-2022034 - Vendor Advisory | |
| References | (MISC) https://www.insyde.com/security-pledge - Vendor Advisory | |
| References | (MISC) https://binarly.io/advisories/BRLY-2022-025/index.html - Exploit, Third Party Advisory |
22 Sep 2022, 00:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-09-22 00:15
Updated : 2023-12-10 14:35
NVD link : CVE-2022-35896
Mitre link : CVE-2022-35896
CVE.ORG link : CVE-2022-35896
JSON object : View
Products Affected
insyde
- insydeh2o
CWE
CWE-20
Improper Input Validation