Lucene search

MitreCVE-2022-35407

HistoryNov 22, 2022 - 2:15 a.m.

CVE-2022-35407

2022-11-2202:15:09

CWE-787

mitre

web.nvd.nist.gov

cve-2022-35407

insydeh2o

setuputility driver

stack buffer overflow

arbitrary code execution

intel platforms

uefi variables

nvd

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

12.6%

JSON

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. A stack buffer overflow leads to arbitrary code execution in the SetupUtility driver on Intel platforms. An attacker can change the values of certain UEFI variables. If the size of the second variable exceeds the size of the first, then the buffer will be overwritten. This issue affects the SetupUtility driver of InsydeH2O.

Affected configurations

Nvd

Node

insydekernelRange5.0–5.5

VendorProductVersionCPE
insydekernel*cpe:2.3:o:insyde:kernel:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
insyde	kernel	*	cpe:2.3:o:insyde:kernel::::::::

References

www.insyde.com/security-pledge

www.insyde.com/security-pledge/SA-2022040

Social References

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

12.6%

JSON

Related for CVE-2022-35407