Lucene search
HistoryNov 23, 2022 - 3:15 a.m.
CVE-2022-36337
insydeh2o
kernel 5.0-5.5
stack buffer overflow
bios code
uefi variable control
arbitrary code execution
CVSS3
8.2
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS
0
Percentile
12.6%
An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. A stack buffer overflow vulnerability in the MebxConfiguration driver leads to arbitrary code execution. Control of a UEFI variable under the OS can cause this overflow when read by BIOS code.
Affected configurations
Node
insydekernelRange5.0–5.5
Related
cvelist
cvelist
CVE-2022-36337
2022-11-23 00:00:00
prion
prion
Stack overflow
2022-11-23 03:15:00
cve
cve
CVE-2022-36337
2022-11-23 03:15:10
CVSS3
8.2
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS
0
Percentile
12.6%
Related for NVD:CVE-2022-36337