CVE-2023-22612

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-22612
An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. A malicious host OS can invoke an Insyde SMI handler with malformed arguments, resulting in memory corruption in SMM.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.0 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://research.nccgroup.com/2023/04/11/stepping-insyde-system-management-mode/ Not Applicable
https://www.insyde.com/security-pledge Vendor Advisory
https://www.insyde.com/security-pledge/SA-2023019 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:insyde:insydeh2o:05.0a.11:*:*:*:*:*:*:*
cpe:2.3:a:insyde:insydeh2o:05.18.03:*:*:*:*:*:*:*
cpe:2.3:a:insyde:insydeh2o:05.28.03:*:*:*:*:*:*:*
cpe:2.3:a:insyde:insydeh2o:05.37.03:*:*:*:*:*:*:*
cpe:2.3:a:insyde:insydeh2o:05.45.01:*:*:*:*:*:*:*
cpe:2.3:a:insyde:insydeh2o:05.53.01:*:*:*:*:*:*:*
History

14 Aug 2023, 18:21

Type Values Removed Values Added
First Time Insyde insydeh2o
CPE cpe:2.3:a:insyde:insydeh20:05.28.03:*:*:*:*:*:*:*
cpe:2.3:a:insyde:insydeh20:05.0a.11:*:*:*:*:*:*:*
cpe:2.3:a:insyde:insydeh20:05.18.03:*:*:*:*:*:*:*
cpe:2.3:a:insyde:insydeh20:05.37.03:*:*:*:*:*:*:*
cpe:2.3:a:insyde:insydeh20:05.53.01:*:*:*:*:*:*:*
cpe:2.3:a:insyde:insydeh20:05.45.01:*:*:*:*:*:*:*		 cpe:2.3:a:insyde:insydeh2o:05.28.03:*:*:*:*:*:*:*
cpe:2.3:a:insyde:insydeh2o:05.18.03:*:*:*:*:*:*:*
cpe:2.3:a:insyde:insydeh2o:05.53.01:*:*:*:*:*:*:*
cpe:2.3:a:insyde:insydeh2o:05.0a.11:*:*:*:*:*:*:*
cpe:2.3:a:insyde:insydeh2o:05.37.03:*:*:*:*:*:*:*
cpe:2.3:a:insyde:insydeh2o:05.45.01:*:*:*:*:*:*:*

26 Apr 2023, 14:02

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8
CPE cpe:2.3:a:insyde:insydeh20:05.45.01:*:*:*:*:*:*:*
cpe:2.3:a:insyde:insydeh20:05.18.03:*:*:*:*:*:*:*
cpe:2.3:a:insyde:insydeh20:05.28.03:*:*:*:*:*:*:*
cpe:2.3:a:insyde:insydeh20:05.0a.11:*:*:*:*:*:*:*
cpe:2.3:a:insyde:insydeh20:05.37.03:*:*:*:*:*:*:*
cpe:2.3:a:insyde:insydeh20:05.53.01:*:*:*:*:*:*:*
CWE CWE-787
References (MISC) https://www.insyde.com/security-pledge/SA-2023019 - (MISC) https://www.insyde.com/security-pledge/SA-2023019 - Vendor Advisory
References (MISC) https://research.nccgroup.com/2023/04/11/stepping-insyde-system-management-mode/ - (MISC) https://research.nccgroup.com/2023/04/11/stepping-insyde-system-management-mode/ - Not Applicable
References (MISC) https://www.insyde.com/security-pledge - (MISC) https://www.insyde.com/security-pledge - Vendor Advisory
First Time Insyde insydeh20
Insyde

11 Apr 2023, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-04-11 21:15

Updated : 2023-12-10 15:01

NVD link : CVE-2023-22612

Mitre link : CVE-2023-22612

CVE.ORG link : CVE-2023-22612

JSON object : View

Products Affected

insyde

  • insydeh2o
CWE
CWE-787

Out-of-bounds Write