Insyde InsydeH2O 安全漏洞

Insyde InsydeH2O is a C source from Insyde Corporation, Taiwan, which implements the new technology "EFI/UEFI" specification designed to replace the traditional BIOS Basic Input/Output System. A security vulnerability exists in Insyde InsydeH2O VariableRuntimeDxe, which arises from the...

CVE-2022-33986

CVE-2022-33986 concerns DMA attacks on the parameter buffer used by the InsydeH2O/VariableRuntimeDxe SMI handler, potentially enabling a TOCTOU attack and SMRAM corruption. Public sources specify the vulnerable component as the VariableRuntimeDxe driver’s SMI handler parameter buffer, with exploi...

CVE-2022-32267

CVE-2022-32267 concerns DMA targeting input buffers used by the SmmResourceCheckDxe SMI handler in InsydeH2O UEFI firmware, leading to SMRAM corruption via a TOCTOU vulnerability. The issue, discovered by Insyde engineering, is mitigated by kernel updates: Kernel 5.2 (05.27.23), 5.3 (05.36.23), 5...

CVE-2022-31243

CVE-2022-31243 describes a TOCTOU race condition affecting the FvbServicesRuntimeDxe driver, where DMA transactions targeting input buffers used by the software SMI handler could cause SMRAM corruption. The issue is part of a broader family of TOCTOU vulnerabilities (multiple CVEs) related to Ins...

CVE-2022-33983

CVE-2022-33983 describes a TOCTOU DMA attack affecting the NvmExpressLegacy SMI handler used by the NvmExpressLegacy driver, potentially enabling SMRAM corruption. The issue is triggered by DMA transactions targeting input buffers for the software SMI handler, with the root cause tied to TOCTOU c...

CVE-2022-33909

CVE-2022-33909 is a TOCTOU-related DMA vulnerability affecting the HddPassword SMI handler in InsydeH2O firmware. The issue arises from DMA transactions targeting input buffers used by the software SMI handler, potentially allowing SMRAM corruption. Public documentation confirms a fix was applied...

CVE-2022-33905

CVE-2022-33905 describes a TOCTOU vulnerability in the AhciBusDxe driver’s SMI input buffers, where DMA targeting those buffers could cause SMRAM corruption. The issue, attributed to Insyde engineering with Intel’s iSTARE context, is fixed in Linux kernels: 5.2 (05.27.23), 5.3 (05.36.23), 5.4 (05...

PT-2022-22158 · Dell · Dell Client Bios

Name of the Vulnerable Software and Affected Versions: Dell Client BIOS versions prior to the remediated version Description: The issue is related to improper input validation, which could be exploited by a local authenticated malicious user. This exploitation could potentially lead to arbitrary...

CVE-2022-36448

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. There is an SMM memory corruption vulnerability in the Software SMI handler in the PnpSmm driver...

CVE-2022-36448

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. There is an SMM memory corruption vulnerability in the Software SMI handler in the PnpSmm driver...

CVE-2022-35894

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. The SMI handler for the FwBlockServiceSmm driver uses an untrusted pointer as the location to copy data to an attacker-specified buffer, leading to information disclosure...

CVE-2022-35894

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. The SMI handler for the FwBlockServiceSmm driver uses an untrusted pointer as the location to copy data to an attacker-specified buffer, leading to information disclosure...

Information disclosure

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. The SMI handler for the FwBlockServiceSmm driver uses an untrusted pointer as the location to copy data to an attacker-specified buffer, leading to information disclosure...

CVE-2022-35894

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. The SMI handler for the FwBlockServiceSmm driver uses an untrusted pointer as the location to copy data to an attacker-specified buffer, leading to information disclosure...

CVE-2022-35894

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. The SMI handler for the FwBlockServiceSmm driver uses an untrusted pointer as the location to copy data to an attacker-specified buffer, leading to information disclosure...

CVE-2022-35894

CVE-2022-35894 affects Insyde InsydeH2O BIOS (kernel versions 5.0–5.5). The vulnerability stems from the SMI handler for the FwBlockServiceSmm driver using an untrusted pointer as the destination to copy data, enabling information disclosure to an attacker-controlled buffer. Public sources consis...

CVE-2022-35408

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An SMM callout vulnerability in the SMM driver in UsbLegacyControlSmm leads to possible arbitrary code execution in SMM and escalation of privileges. An attacker could overwrite the function pointers in the EFIBOOTSERVICES...

Code injection

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An SMM callout vulnerability in the SMM driver in UsbLegacyControlSmm leads to possible arbitrary code execution in SMM and escalation of privileges. An attacker could overwrite the function pointers in the EFIBOOTSERVICES...

CVE-2022-35408

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An SMM callout vulnerability in the SMM driver in UsbLegacyControlSmm leads to possible arbitrary code execution in SMM and escalation of privileges. An attacker could overwrite the function pointers in the EFIBOOTSERVICES...

PT-2022-23002 · Insyde · Insydeh2O

Name of the Vulnerable Software and Affected Versions: Insyde InsydeH2O with kernel versions 5.0 through 5.5 Description: An issue was discovered where the SMI handler for the FwBlockServiceSmm driver uses an untrusted pointer as the location to copy data to an attacker-specified buffer, leading ...