CVE-2022-24421

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM...

CVE-2022-24416

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM...

Input validation

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM...

Input validation

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM...

Input validation

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM...

Input validation

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM...

CVE-2022-24421

Dell BIOS contains an improper input validation vulnerability that allows a local authenticated attacker to trigger arbitrary code execution in System Management Mode (SMM) via an SMI. Affected Dell products include Inspiron, Vostro, XPS, Alienware, and Edge Gateway 3000 Series. The root cause is...

CVE-2022-24421

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM...

CVE-2022-24420

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM...

CVE-2022-24420

Dell BIOS CVE-2022-24420 involves an improper input validation vulnerability that allows a local authenticated attacker to execute arbitrary code in the System Management Mode (SMM) using an SMI. Affected Dell products include several Dell BIOS-bearing systems (e.g., Inspiron, Vostro, XPS, Alienw...

CVE-2022-24419

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM...

CVE-2022-24419

Dell BIOS contains an improper input validation vulnerability that can be exploited locally by an authenticated attacker using an SMI to gain arbitrary code execution in System Management Mode (SMM). Affected are Dell BIOS firmware components across several systems (e.g., Inspiron, Vostro, XPS, A...

CVE-2022-24416

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM...

CVE-2022-24415

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM...

CVE-2022-24415

Dell BIOS contains an improper input validation vulnerability that can be exploited by a local authenticated attacker using an SMI to gain arbitrary code execution during System Management Mode (SMM). Several sources describe this family of flaws (CVE-2022-24415) as affecting Dell BIOS across mul...

CVE-2021-33627

An issue was discovered in Insyde InsydeH2O Kernel 5.0 before 05.09.11, 5.1 before 05.17.11, 5.2 before 05.27.11, 5.3 before 05.36.11, 5.4 before 05.44.11, and 5.5 before 05.52.11 affecting FwBlockServiceSmm. Software SMI services that use the Communicate function of the EFISMMCOMMUNICATIONPROTOC...

Design/Logic Flaw

An issue was discovered in Kernel 5.x in Insyde InsydeH2O, affecting HddPassword. Software SMI services that use the Communicate function of the EFISMMCOMMUNICATIONPROTOCOL do not check whether the address of the buffer is valid, which allows use of SMRAM, MMIO, or OS kernel addresses...

CVE-2021-33625

Mode C: Normal (concrete details present) Vulnerability: InsydeH2O firmware (Kernel 5.x) used by HddPassword suffers an SMM/SMI buffer validation flaw. Software SMI services that use the EFI_SMM_COMMUNICATION_PROTOCOL’s Communicate() do not verify the buffer address, enabling access to SMRAM, MMI...

CVE-2021-33627

CVE-2021-33627 affects Insyde InsydeH2O 5.x (FwBlockServiceSmm). The SMM Communicate() handling does not validate the buffer address, enabling use of SMRAM, MMIO, or OS kernel addresses. Impact: local attacker could escalate to SMM execution and potentially compromise SMRAM or firmware. Fixed in ...

Insyde InsydeH2O 缓冲区错误漏洞

Insyde InsydeH2O is a C source from Insyde Software Taiwan, China that implements the new technology "EFI/UEFI" specification, designed to replace the legacy BIOS Basic Input/Output System. The vulnerability can be exploited to read or write to or manipulate data in SMRAM, resulting in an...