CVE-2023-28468

2023-08-0300:00:00

mitre

www.cve.org

cve-2023-28468

insydeh2o

kernel 5.0-5.5

smm module

smi handler

spi flash

os interaction

AI Score

6.5

Confidence

High

EPSS

Percentile

9.0%

JSON

An issue was discovered in FvbServicesRuntimeDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. The FvbServicesRuntimeDxe SMM module exposes an SMI handler that allows an attacker to interact with the SPI flash at run-time from the OS.

References

www.insyde.com/security-pledge

www.insyde.com/security-pledge/SA-2023039