Lucene search

MitreCVE-2022-32475

HistoryFeb 15, 2023 - 2:15 p.m.

CVE-2022-32475

2023-02-1514:15:11

CWE-367

mitre

web.nvd.nist.gov

cve

insyde insydeh2o

kernel

toctou

race-condition

smram

privilege escalation

nvd

security vulnerability

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.1

Confidence

High

EPSS

Percentile

13.2%

JSON

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the VariableRuntimeDxe shared buffer used by SMM and non-SMM code could cause TOCTOU race-condition issues that could lead to corruption of SMRAM and escalation of privileges. This issue was fixed in the kernel, which also protected chipset and OEM chipset code.

Affected configurations

Nvd

Node

insydeinsydeh2oRange5.0–5.2.05.27.27

insydeinsydeh2oRange5.3–5.3.05.36.27

insydeinsydeh2oRange5.4–5.4.05.44.27

insydeinsydeh2oRange5.5–5.5.05.52.27

VendorProductVersionCPE
insydeinsydeh2o*cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
insyde	insydeh2o	*	cpe:2.3:a:insyde:insydeh2o::::::::

References

www.insyde.com/security-pledge

www.insyde.com/security-pledge/SA-2023007

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.1

Confidence

High

EPSS

Percentile

13.2%

JSON

Related for CVE-2022-32475