CVE-2024-52880

An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel 5.5 before version 05.54.50, kernel 5.6 before version 05.61.50, and kernel 5.7 before version 05.70.50. In VariableRuntimeDxe driver,...

CVE-2024-52880

A security vulnerability exists in the Insyde InsydeH2O kernel (versions 5.2 through 5.7) involving a buffer over-read in the VariableRuntimeDxe driver . The issue occurs because the SecureBootHandler relies on DataSize and VariableNameSize values supplied by the caller, which cannot be trusted. ...