Lucene search

MitreCVE-2023-28468

HistoryAug 03, 2023 - 3:15 p.m.

CVE-2023-28468

2023-08-0315:15:20

CWE-863

mitre

web.nvd.nist.gov

cve-2023-28468

insyde insydeh2o

fvbservicesruntimedxe

smm module

smi handler

spi flash

nvd

CVSS3

6.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

AI Score

6.3

Confidence

High

EPSS

Percentile

9.0%

JSON

An issue was discovered in FvbServicesRuntimeDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. The FvbServicesRuntimeDxe SMM module exposes an SMI handler that allows an attacker to interact with the SPI flash at run-time from the OS.

Affected configurations

Nvd

Node

insydekernelRange5.0–5.5

VendorProductVersionCPE
insydekernel*cpe:2.3:o:insyde:kernel:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
insyde	kernel	*	cpe:2.3:o:insyde:kernel::::::::

References

www.insyde.com/security-pledge

www.insyde.com/security-pledge/SA-2023039

CVSS3

6.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

AI Score

6.3

Confidence

High

EPSS

Percentile

9.0%

JSON

Related for CVE-2023-28468