CVE-2022-24420: Improper Restriction of Operations within the Bounds of a Memory Buffer

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM...

CVE-2022-24419: Improper Restriction of Operations within the Bounds of a Memory Buffer

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM...

CVE-2022-24415: Improper Restriction of Operations within the Bounds of a Memory Buffer

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM...

CVE-2022-24416: Improper Restriction of Operations within the Bounds of a Memory Buffer

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM...

CVE-2022-24421: Improper Restriction of Operations within the Bounds of a Memory Buffer

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM...

PT-2022-1899 · Dell · Dell Bios

Name of the Vulnerable Software and Affected Versions: Dell BIOS affected versions not specified Description: The issue is caused by an improper input validation vulnerability in Dell BIOS, which may allow a local authenticated malicious user to gain arbitrary code execution during SMM by using a...

UBUNTU-CVE-2021-38578

Existing CommBuffer checks in SmmEntryPoint will not catch underflow when computing BufferSize...

GSD-2022-1000612 KVM: x86: Forcibly leave nested virt when SMM state is toggled

KVM: x86: Forcibly leave nested virt when SMM state is toggled This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.5 by commit...

PT-2022-28886

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to 5.16.5 Description The issue is related to KVM x86 and nested virtualization, specifically when the SMM state is toggled. The actual impact and attack plausibility have not yet been proven. Recommendations For...

GSD-2022-1000188 KVM: x86: Forcibly leave nested virt when SMM state is toggled

KVM: x86: Forcibly leave nested virt when SMM state is toggled This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.97 by commit...

PT-2022-28526

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.19 Description The issue is related to KVM x86 and forcibly leaving nested virtualization when the SMM state is toggled. The actual impact and attack plausibility have not yet been proven. Recommendations F...

PT-2022-28466

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to 5.10.97 Description The issue is related to KVM x86, where the system forcibly leaves nested virtualization when the SMM state is toggled. The actual impact and attack plausibility have not yet been proven...

Authentication flaw

A potential vulnerability in AMD System Management Mode SMM interrupt handler may allow an attacker with high privileges to access the SMM resulting in arbitrary code execution which could be used by malicious actors to bypass security mechanisms provided in the UEFI firmware...

CVE-2021-39298

A potential vulnerability in AMD System Management Mode SMM interrupt handler may allow an attacker with high privileges to access the SMM resulting in arbitrary code execution which could be used by malicious actors to bypass security mechanisms provided in the UEFI firmware...

CVE-2021-39298

CVE-2021-39298 concerns AMD SMM (System Management Mode) interrupt handler. The AMD AMD-SB-1027/AMD-SB-1032 entries describe a vulnerability where a highly-privileged adversary could access SMM and achieve arbitrary code execution, potentially bypassing UEFI firmware security measures. Affected c...

CVE-2021-39298

A potential vulnerability in AMD System Management Mode SMM interrupt handler may allow an attacker with high privileges to access the SMM resulting in arbitrary code execution which could be used by malicious actors to bypass security mechanisms provided in the UEFI firmware...

CVE-2021-39298: Undefined Security Weakness

A potential vulnerability in AMD System Management Mode SMM interrupt handler may allow an attacker with high privileges to access the SMM resulting in arbitrary code execution which could be used by malicious actors to bypass security mechanisms provided in the UEFI firmware...

Insyde InsydeH2O has an unspecified vulnerability (CNVD-2022-10283)

Insyde InsydeH2O is a C source from Insyde Software Taiwan, China that implements the new technology "EFI/UEFI" specification, designed to replace the legacy BIOS Basic Input/Output System. The vulnerability can be exploited to read or write or manipulate data to SMRAM, resulting in an escalation...

Insyde InsydeH2O has an unspecified vulnerability (CNVD-2022-10284)

Insyde InsydeH2O is a C source from Insyde Software Taiwan, China that implements the new technology "EFI/UEFI" specification, designed to replace the traditional BIOS Basic Input/Output System. Operating System H2O UEFI firmware has a security vulnerability that could be exploited to elevate...

Insyde InsydeH2O Buffer Overflow Vulnerability (CNVD-2022-10287)

Insyde InsydeH2O is a C source from Insyde Software Taiwan, China that implements the new technology "EFI/UEFI" specification, designed to replace the legacy BIOS Basic Input/Output System. -A buffer overflow vulnerability in the 2-Operating System H2O UEFI firmware could be exploited to write...