Insyde InsydeH2O Buffer Overflow Vulnerability (CNVD-2022-10290)

Insyde InsydeH2O is a C source from Insyde Software (Taiwan, China) that implements the new technology “EFI/UEFI” specification, designed to replace the legacy BIOS (Basic Input/Output System). A buffer overflow vulnerability exists in InsydeH2O, which stems from the SWSMI handler not adequately checking or validating the allocated buffer pointers. No detailed vulnerability details are currently available.