CVE-2022-35408

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An SMM callout vulnerability in the SMM driver in UsbLegacyControlSmm leads to possible arbitrary code execution in SMM and escalation of privileges. An attacker could overwrite the function pointers in the EFIBOOTSERVICES...

Code injection

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An SMM callout vulnerability in the SMM driver in UsbLegacyControlSmm leads to possible arbitrary code execution in SMM and escalation of privileges. An attacker could overwrite the function pointers in the EFIBOOTSERVICES...

CVE-2022-35896

An issue SMM memory leak vulnerability in SMM driver SMRAM was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An attacker can dump SMRAM contents via the software SMI provided by the FvbServicesRuntimeDxe driver to read the contents of SMRAM, leading to information disclosure...

CVE-2022-35896

An issue SMM memory leak vulnerability in SMM driver SMRAM was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An attacker can dump SMRAM contents via the software SMI provided by the FvbServicesRuntimeDxe driver to read the contents of SMRAM, leading to information disclosure...

Memory corruption

An issue SMM memory leak vulnerability in SMM driver SMRAM was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An attacker can dump SMRAM contents via the software SMI provided by the FvbServicesRuntimeDxe driver to read the contents of SMRAM, leading to information disclosure...

PT-2022-22809 · Insyde · Insydeh2O

Name of the Vulnerable Software and Affected Versions: Insyde InsydeH2O versions 5.0 through 5.5 Description: An issue was discovered in Insyde InsydeH2O, where an SMM callout vulnerability in the SMM driver in UsbLegacyControlSmm leads to possible arbitrary code execution in SMM and escalation o...

CVE-2022-35896

An issue SMM memory leak vulnerability in SMM driver SMRAM was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An attacker can dump SMRAM contents via the software SMI provided by the FvbServicesRuntimeDxe driver to read the contents of SMRAM, leading to information disclosure...

CVE-2022-35896

The CVE-2022-35896 issue affects InsydeH2O BIOS (InsydeH2O) affecting SMM memory handling via the FvbServicesRuntimeDxe driver. The root cause is a memory leak/read path in the SMM driver that could allow an attacker with local access to dump SMRAM contents, leading to information disclosure. Aff...

CVE-2022-35895

CVE-2022-35895 affects Insyde InsydeH2O BIOS (kernel 5.0–5.5). The vulnerability lies in the FwBlockSericceSmm driver, which fails to validate input for a software SMI routine, enabling memory corruption of arbitrary addresses including SMRAM and potentially arbitrary code execution. Exploitation...

PT-2022-23003

Name of the Vulnerable Software and Affected Versions Insyde InsydeH2O versions 5.0 through 5.5 Description An issue was discovered in the FwBlockSericceSmm driver, which does not properly validate input parameters for a software SMI routine. This leads to memory corruption of arbitrary addresses...

CVE-2022-35895: Out-of-bounds Write

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. The FwBlockSericceSmm driver does not properly validate input parameters for a software SMI routine, leading to memory corruption of arbitrary addresses including SMRAM, and possible arbitrary code execution...

The vulnerability of the IdeBusDxe component in the InsydeH2O UEFI firmware creation framework, which involves writing beyond the buffer boundaries in memory, allows an attacker to execute arbitrary code on the target system.

The vulnerability of the IdeBusDxe component in the InsydeH2O UEFI firmware creation framework involves writing beyond the buffer boundaries in memory. Exploiting this vulnerability allows an attacker to execute arbitrary code on the target system...

Insyde InsydeH2O permission permission and access control issues vulnerability (CNVD-2022-10274)

Insyde InsydeH2O is a C source from Insyde Software Taiwan, China that implements the new technology "EFI/UEFI" specification, designed to replace the traditional BIOS Basic Input/Output System. Operating System H2O UEFI firmware is vulnerable to permission and access control issues, which can be...

Insyde InsydeH2O Buffer Overflow Vulnerability (CNVD-2022-10272)

Insyde InsydeH2O is a C source from Insyde Software Taiwan, China that implements the new technology "EFI/UEFI" specification, designed to replace the legacy BIOS Basic Input/Output System. Operating System H2O UEFI firmware has a buffer overflow vulnerability that can be exploited to write fixed...

Insyde InsydeH2O Buffer Overflow Vulnerability (CNVD-2022-10277)

Insyde InsydeH2O is a C source from Insyde Software Taiwan, China that implements the new technology "EFI/UEFI" specification, designed to replace the legacy BIOS Basic Input/Output System. Operating System H2O UEFI firmware suffers from a buffer overflow vulnerability that could be exploited by ...

Insyde InsydeH2O has an unspecified vulnerability (CNVD-2022-10279)

Insyde InsydeH2O is a C source from Insyde Software Taiwan, China that implements the new technology "EFI/UEFI" specification, designed to replace the traditional BIOS Basic Input/Output System. Operating System H2O UEFI firmware contains a security vulnerability that can be exploited by attacker...

Insyde InsydeH2O Buffer Overflow Vulnerability (CNVD-2022-10275)

Insyde InsydeH2O is a C source from Insyde Software Taiwan, China that implements the new technology "EFI/UEFI" specification, designed to replace the legacy BIOS Basic Input/Output System. Operating System H2O UEFI firmware has a buffer overflow vulnerability that can be exploited to write fixed...

Insyde InsydeH2O Buffer Overflow Vulnerability (CNVD-2022-10273)

Insyde InsydeH2O is a C source from Insyde Software Taiwan, China that implements the new technology "EFI/UEFI" specification, designed to replace the legacy BIOS Basic Input/Output System. Operating System H2O UEFI firmware has a buffer overflow vulnerability that can be exploited to write fixed...

Insyde InsydeH2O has an unspecified vulnerability (CNVD-2022-10288)

Insyde InsydeH2O is a C source from Insyde Software Taiwan, China that implements the new technology "EFI/UEFI" specification, designed to replace the legacy BIOS Basic Input/Output System.A security vulnerability exists in Insyde InsydeH2O. The vulnerability stems from the System Management...

Insyde InsydeH2O has an unspecified vulnerability (CNVD-2022-10282)

Insyde InsydeH2O is a C source from Insyde Software Taiwan, China that implements the new technology "EFI/UEFI" specification, designed to replace the legacy BIOS Basic Input/Output System. The vulnerability can be exploited to read or write to or manipulate data in SMRAM, resulting in an...