CVE-2023-34195

Insyde InsydeH2O (kernel 5.0–5.5) contains a vulnerability in SystemFirmwareManagementRuntimeDxe where GetImage reads a runtime variable GetImageProgress and later uses its value as a function pointer. The GetImageProgress variable is wiped by the same module before function end. If an OS sets th...