Insyde InsydeH2O Elevation of Privilege Vulnerability

2022-09-2800:00:00

China National Vulnerability Database

www.cnvd.org.cn

8.2 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

JSON

Insyde InsydeH2O is a C source from Insyde Software (Taiwan, China) that implements the new technology “EFI/UEFI” specification, designed to replace the legacy BIOS (Basic Input/Output System).Insyde InsydeH2O suffers from an elevation of privilege vulnerability that stems from An SMM memory corruption issue in its FvbServicesRuntimeDxe driver could be exploited to write fixed or predictable data to SMRAM, resulting in an elevation of privilege to SMM.

CPENameOperatorVersion
insyde insydeh2o >=5.0，lt05.09.37
insyde insydeh2o >=5.1，lt05.17.37
insyde insydeh2o >=5.2，lt05.27.29
insyde insydeh2o >=5.3，lt05.36.29
insyde insydeh2o >=5.4，lt05.44.29
insyde insydeh2o >=5.5，lt05.52.29

Name	Operator	Version
insyde insydeh2o >=5.0，	lt	05.09.37
insyde insydeh2o >=5.1，	lt	05.17.37
insyde insydeh2o >=5.2，	lt	05.27.29
insyde insydeh2o >=5.3，	lt	05.36.29
insyde insydeh2o >=5.4，	lt	05.44.29
insyde insydeh2o >=5.5，	lt	05.52.29