CVE-2022-29277

Incorrect pointer checks within the the FwBlockServiceSmm driver can allow arbitrary RAM modifications During review of the FwBlockServiceSmm driver, certain instances of SpiAccessLib could be tricked into writing 0xff to arbitrary system and SMRAM addresses. Fixed in: INTEL Purley-R: 05.21.51.00...

PT-2022-19517 · Intel · Fwblockservicesmm

Name of the Vulnerable Software and Affected Versions: FwBlockServiceSmm driver versions prior to 05.21.51.0048 FwBlockServiceSmm driver versions prior to 05.42.23.0066 FwBlockServiceSmm driver versions prior to 05.42.11.0021 FwBlockServiceSmm driver versions prior to 05.44.25.0052...

CVE-2022-33906

DMA transactions which are targeted at input buffers used for the FwBlockServiceSmm software SMI handler could cause SMRAM corruption through a TOCTOU attack. DMA transactions which are targeted at input buffers used for the software SMI handler used by the FwBlockServiceSmm driver could cause...

CVE-2022-33906

DMA transactions which are targeted at input buffers used for the FwBlockServiceSmm software SMI handler could cause SMRAM corruption through a TOCTOU attack. DMA transactions which are targeted at input buffers used for the software SMI handler used by the FwBlockServiceSmm driver could cause...

Design/Logic Flaw

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An SMM callout vulnerability in the SMM driver FwBlockServiceSmm, creating SMM, leads to arbitrary code execution. An attacker can replace the pointer to the UEFI boot service GetVariable with a pointer to malware, and then...

CVE-2022-36338

CVE-2022-36338 (Siemens InsydeH2O) affects InsydeH2O BIOS/firmware (kernel 5.0–5.5). The issue is an SMM callout vulnerability in the SMM driver FwBlockServiceSmm that creates SMM and allows arbitrary code execution. An attacker can replace the pointer to the UEFI boot service GetVariable with ma...

CVE-2022-35894

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. The SMI handler for the FwBlockServiceSmm driver uses an untrusted pointer as the location to copy data to an attacker-specified buffer, leading to information disclosure...

CVE-2022-35894

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. The SMI handler for the FwBlockServiceSmm driver uses an untrusted pointer as the location to copy data to an attacker-specified buffer, leading to information disclosure...

Information disclosure

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. The SMI handler for the FwBlockServiceSmm driver uses an untrusted pointer as the location to copy data to an attacker-specified buffer, leading to information disclosure...

CVE-2022-35894

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. The SMI handler for the FwBlockServiceSmm driver uses an untrusted pointer as the location to copy data to an attacker-specified buffer, leading to information disclosure...

CVE-2022-35894

CVE-2022-35894 affects Insyde InsydeH2O BIOS (kernel versions 5.0–5.5). The vulnerability stems from the SMI handler for the FwBlockServiceSmm driver using an untrusted pointer as the destination to copy data, enabling information disclosure to an attacker-controlled buffer. Public sources consis...

PT-2022-23002 · Insyde · Insydeh2O

Name of the Vulnerable Software and Affected Versions: Insyde InsydeH2O with kernel versions 5.0 through 5.5 Description: An issue was discovered where the SMI handler for the FwBlockServiceSmm driver uses an untrusted pointer as the location to copy data to an attacker-specified buffer, leading ...

Design/Logic Flaw

An issue was discovered in Insyde InsydeH2O 5.x, affecting FwBlockServiceSmm. Software SMI services that use the Communicate function of the EFISMMCOMMUNICATIONPROTOCOL do not check whether the address of the buffer is valid, which allows use of SMRAM, MMIO, or OS kernel addresses...

CVE-2021-33627

CVE-2021-33627 affects Insyde InsydeH2O 5.x (FwBlockServiceSmm). The SMM Communicate() handling does not validate the buffer address, enabling use of SMRAM, MMIO, or OS kernel addresses. Impact: local attacker could escalate to SMM execution and potentially compromise SMRAM or firmware. Fixed in ...