CVE-2021-33834

An issue was discovered in iscflashx64.sys 3.9.3.0 in Insyde H2OFFT 6.20.00. When handling IOCTL 0x22229a, the input used to allocate a buffer and copy memory is mishandled. This could cause memory corruption or a system crash...

CVE-2021-33834

An issue was discovered in iscflashx64.sys 3.9.3.0 in Insyde H2OFFT 6.20.00. When handling IOCTL 0x22229a, the input used to allocate a buffer and copy memory is mishandled. This could cause memory corruption or a system crash...

Memory corruption

An issue was discovered in iscflashx64.sys 3.9.3.0 in Insyde H2OFFT 6.20.00. When handling IOCTL 0x22229a, the input used to allocate a buffer and copy memory is mishandled. This could cause memory corruption or a system crash...

CVE-2021-33834

The CVE-2021-33834 issue affects iscflashx64.sys 3.9.3.0 in Insyde H2OFFT 6.20.00. When handling IOCTL 0x22229a, input used to allocate a buffer and copy memory is mishandled, leading to memory corruption or a system crash. Red Hat and NVD entries confirm the same vulnerability across multiple ad...

CVE-2021-33834

An issue was discovered in iscflashx64.sys 3.9.3.0 in Insyde H2OFFT 6.20.00. When handling IOCTL 0x22229a, the input used to allocate a buffer and copy memory is mishandled. This could cause memory corruption or a system crash...

CVE-2021-33834

An issue was discovered in iscflashx64.sys 3.9.3.0 in Insyde H2OFFT 6.20.00. When handling IOCTL 0x22229a, the input used to allocate a buffer and copy memory is mishandled. This could cause memory corruption or a system crash...

CVE-2023-27471

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. UEFI implementations do not correctly protect and validate information contained in the 'MeSetup' UEFI variable. On some systems, this variable can be overwritten using operating system APIs. Exploitation of this vulnerabili...

CVE-2023-27471

CVE-2023-27471 affects Insyde InsydeH2O BIOS/UEFI (kernel 5.0–5.5). The vulnerability arises from improper protection/validation of the MeSetup UEFI variable, which on some systems can be overwritten via OS APIs. Exploitation could lead to a platform denial of service, according to the available ...

PT-2023-21149 · Insyde · Insydeh2O

Name of the Vulnerable Software and Affected Versions: Insyde InsydeH2O with kernel 5.0 through 5.5 Description: An issue was discovered in Insyde InsydeH2O where UEFI implementations do not correctly protect and validate information contained in the MeSetup UEFI variable. On some systems, this...

CVE-2023-31041

CVE-2023-31041 concerns InsydeH2O BIOS (SysPasswordDxe) where system password information may be stored in cleartext on kernel versions 5.0–5.5. The issue enables potential information disclosure due to plaintext password storage, as described across multiple sources (Red Hat, Red Hat RIS, NVD, T...

CVE-2023-27373

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. Due to insufficient input validation, an attacker can tamper with a runtime-accessible EFI variable to cause a dynamic BAR setting to overlap SMRAM...

CVE-2023-27373

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. Due to insufficient input validation, an attacker can tamper with a runtime-accessible EFI variable to cause a dynamic BAR setting to overlap SMRAM...

Code injection

An issue was discovered in FvbServicesRuntimeDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. The FvbServicesRuntimeDxe SMM module exposes an SMI handler that allows an attacker to interact with the SPI flash at run-time from the OS...

CVE-2023-28468

CVE-2023-28468 : InsydeH2O BIOS’ FvbServicesRuntimeDxe (SMM) exposes an SMI handler that enables the OS to interact with the SPI flash at run-time. Affects InsydeInsydeH2O (FvbServicesRuntimeDxe SMM module) on kernel 5.0–5.5. According to the available references, this can lead to local access wi...

Insyde InsydeH2O Buffer Error Vulnerability

Insyde InsydeH2O is a C-language source from Insyde Corporation of Taiwan that implements the new technology "EFI/UEFI" specification, designed to replace the traditional BIOS Basic Input/Output System. Insyde InsydeH2O contains a security vulnerability that can be exploited by a malicious...

Insyde InsydeH2O Security Breach

Insyde InsydeH2O is a C-language source from Insyde Corporation of Taiwan that implements the new technology "EFI/UEFI" specification, designed to replace the traditional BIOS Basic Input/Output System. A security vulnerability exists in Insyde InsydeH2O, which stems from the FvbServicesRuntimeDx...

The vulnerability of the ChipsetSvcSmm component in the InsydeH2O UEFI firmware creation framework allows a attacker to cause memory corruption.

The vulnerability of the ChipsetSvcSmm component in the InsydeH2O UEFI firmware development framework is related to the execution of operations outside of the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause memory corruption...

The vulnerability of the IhisiSmm component of the InsydeH2O UEFI firmware creation framework allows a hacker to induce a service failure.

The vulnerability of the IhisiSmm component in the InsydeH2O UEFI firmware creation framework is related to state management errors. Exploiting this vulnerability could allow a remote attacker to cause system failures...

CVE-2022-24350

An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. IHISI function 0x17 verifies that the output buffer lies within the command buffer but does not verify that output data does not go beyond the end of the command buffer. In particular, the GetFlashTable function ...

CVE-2023-22616

CVE-2023-22616 affects Insyde InsydeH2O BIOS (kernel 5.2–5.5) with the IhisiSmm driver failing to validate the Save State register before use, enabling potential SMRAM corruption due to insufficient input validation. The documents specify the vulnerability and impact but do not provide an explici...