CVE-2021-33834

2023-09-0802:15:07

CWE-787

[email protected]

web.nvd.nist.gov

cve-2021-33834

insyde h2offt

ioctl 0x22229a

memory corruption

system crash

CVSS3

7.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

EPSS

Percentile

9.0%

JSON

An issue was discovered in iscflashx64.sys 3.9.3.0 in Insyde H2OFFT 6.20.00. When handling IOCTL 0x22229a, the input used to allocate a buffer and copy memory is mishandled. This could cause memory corruption or a system crash.

Affected configurations

Nvd

Node

insydeh2offtMatch6.20.00

insydeiscflashx64.sysMatch3.9.3.0

VendorProductVersionCPE
insydeh2offt6.20.00cpe:2.3:a:insyde:h2offt:6.20.00:*:*:*:*:*:*:*
insydeiscflashx64.sys3.9.3.0cpe:2.3:a:insyde:iscflashx64.sys:3.9.3.0:*:*:*:*:*:*:*