CVE-2022-32477

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the FvbServicesRuntimeDxe shared buffer used by SMM and non-SMM code could cause TOCTOU race-condition issues that could lead to corruption of SMRAM and escalation of privileges. This attack can be mitigated...

SUSE CVE-2018-12472

A improper authentication using the HOST header in SUSE Linux SMT allows remote attackers to spoof a sibling server. Affected releases are SUSE Linux SMT: versions prior to 3.0.37...

SUSE CVE-2020-12951

Race condition in ASP firmware could allow less privileged x86 code to perform ASP SMM System Management Mode operations...

SUSE CVE-2020-12961

A potential vulnerability exists in AMD Platform Security Processor PSP that may allow an attacker to zero any privileged register on the System Management Network which may lead to bypassing SPI ROM protections...

SUSE CVE-2021-26329

AMD System Management Unit SMU may experience an integer overflow when an invalid length is provided which may result in a potential loss of resources...

SUSE CVE-2021-26330

AMD System Management Unit SMU may experience a heap-based overflow which may result in a loss of resources...

SUSE CVE-2021-26331

AMD System Management Unit SMU contains a potential issue where a malicious user may be able to manipulate mailbox entries leading to arbitrary code execution...

SUSE CVE-2021-26336

Insufficient bounds checking in System Management Unit SMU may cause invalid memory accesses/updates that could result in SMU hang and subsequent failure to service any further requests from other components...

SUSE CVE-2021-26337

Insufficient DRAM address validation in System Management Unit SMU may result in a DMA read from invalid DRAM address to SRAM resulting in SMU not servicing further requests...

SUSE CVE-2021-26338

Improper access controls in System Management Unit SMU may allow for an attacker to override performance control tables located in DRAM resulting in a potential lack of system resources...

SUSE CVE-2021-26350

A TOCTOU race condition in SMU may allow for the caller to obtain and manipulate the address of a message port register which may result in a potential denial of service...

SUSE CVE-2021-26373

Insufficient bound checks in the System Management Unit SMU may result in a system voltage malfunction that could result in denial of resources and/or possibly denial of service...

SUSE CVE-2021-26372

Insufficient bound checks related to PCIE in the System Management Unit SMU may result in access to an invalid address space that could result in denial of service...

SUSE CVE-2021-26376

Insufficient checks in System Management Unit SMU FeatureConfig may result in reenabling features potentially resulting in denial of resources and/or denial of service...

SUSE CVE-2021-26375

Insufficient General Purpose IO GPIO bounds check in System Management Unit SMU may result in access/updates from/to invalid address space that could result in denial of service...

SUSE CVE-2021-26378

Insufficient bound checks in the System Management Unit SMU may result in access to an invalid address space that could result in denial of service...

CVE-2022-32478

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the IdeBusDxe shared buffer used by SMM and non-SMM code could cause TOCTOU race-condition issues that could lead to corruption of SMRAM and escalation of privileges. This attack can be mitigated using IOMMU...

The vulnerability of the System Management Unit (SMU) component of AMD processors allows a hacker to trigger a service failure.

The vulnerability of the System Management Unit SMU component of AMD processors arises from operations that occur outside the buffer in memory. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

The vulnerability of the System Management Unit (SMU) component of AMD processors allows a hacker to trigger a service failure.

The vulnerability of the System Management Unit SMU component of AMD processors arises from operations that occur outside the buffer in memory. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

Insyde InsydeH2O 安全漏洞

Insyde InsydeH2O is a C source from Insyde Corporation of Taiwan, which implements the new technology "EFI/UEFI" specification, designed to replace the traditional BIOS Basic Input/Output System. A security vulnerability exists in Insyde InsydeH2O with kernel versions 5.1 through 5.5. An attacker...