PT-2022-21191 · Insyde · Insydeh2O

Name of the Vulnerable Software and Affected Versions: Insyde InsydeH2O versions 5.0 through 5.5 Insyde InsydeH2O Kernel 5.3 version 05.36.23 Insyde InsydeH2O Kernel 5.4 version 05.44.23 Insyde InsydeH2O Kernel 5.5 version 05.52.23 Description: The issue arises from DMA attacks on the parameter...

CVE-2022-30774

DMA attacks on the parameter buffer used by the PnpSmm driver could change the contents after parameter values have been checked but before they are used a TOCTOU attack DMA attacks on the parameter buffer used by the PnpSmm driver could change the contents after parameter values have been checke...

CVE-2022-32266

DMA attacks on the parameter buffer used by a software SMI handler used by the driver PcdSmmDxe could lead to a TOCTOU attack on the SMI handler and lead to corruption of other ACPI fields and adjacent memory fields. DMA attacks on the parameter buffer used by a software SMI handler used by the...

CVE-2022-30773

CVE-2022-30773 describes DMA attacks against the parameter buffer of the IhisiSmm driver, enabling a TOCTOU where an attacker could alter data after parameter validation but before use. The issue is addressed by kernel fixes: Kernel 5.4 (05.44.23) and Kernel 5.5 (05.52.23). Affected component: Ih...

CVE-2022-33906

DMA transactions which are targeted at input buffers used for the FwBlockServiceSmm software SMI handler could cause SMRAM corruption through a TOCTOU attack. DMA transactions which are targeted at input buffers used for the software SMI handler used by the FwBlockServiceSmm driver could cause...

CVE-2022-33984

DMA transactions which are targeted at input buffers used for the SdMmcDevice software SMI handler could cause SMRAM corruption through a TOCTOU attack. DMA transactions which are targeted at input buffers used for the software SMI handler used by the SdMmcDevice driver could cause SMRAM corrupti...

CVE-2022-33984

DMA transactions which are targeted at input buffers used for the SdMmcDevice software SMI handler could cause SMRAM corruption through a TOCTOU attack. DMA transactions which are targeted at input buffers used for the software SMI handler used by the SdMmcDevice driver could cause SMRAM corrupti...

CVE-2022-33983

DMA transactions which are targeted at input buffers used for the NvmExpressLegacy software SMI handler could cause SMRAM corruption through a TOCTOU attack. DMA transactions which are targeted at input buffers used for the software SMI handler used by the NvmExpressLegacy driver could cause SMRA...

CVE-2022-33908

DMA transactions which are targeted at input buffers used for the SdHostDriver software SMI handler could cause SMRAM corruption through a TOCTOU attack. DMA transactions which are targeted at input buffers used for the software SMI handler used by the SdHostDriver driver could cause SMRAM...

PT-2022-21944 · Insyde · Int15Servicesmm

Name of the Vulnerable Software and Affected Versions: Int15ServiceSmm software SMI handler versions prior to Kernel 5.2: 05.27.23 Int15ServiceSmm software SMI handler versions prior to Kernel 5.3: 05.36.23 Int15ServiceSmm software SMI handler versions prior to Kernel 5.4: 05.44.23 Int15ServiceSm...

CVE-2022-33985

DMA transactions which are targeted at input buffers used for the NvmExpressDxe software SMI handler could cause SMRAM corruption through a TOCTOU attack. DMA transactions which are targeted at input buffers used for the software SMI handler used by the NvmExpressDxe driver could cause SMRAM...

CVE-2022-33983

DMA transactions which are targeted at input buffers used for the NvmExpressLegacy software SMI handler could cause SMRAM corruption through a TOCTOU attack. DMA transactions which are targeted at input buffers used for the software SMI handler used by the NvmExpressLegacy driver could cause SMRA...

CVE-2022-33986

DMA attacks on the parameter buffer used by the VariableRuntimeDxe software SMI handler could lead to a TOCTOU attack. DMA attacks on the parameter buffer used by the software SMI handler used by the driver VariableRuntimeDxe could lead to a TOCTOU attack on the SMI handler and lead to corruption...

CVE-2022-33907

CVE-2022-33907 describes a TOCTOU vulnerability in the SMI handler input buffers of the InsydeH2O IdeBusDxe driver. DMA accesses targeting these buffers could lead to SMRAM corruption. The issue is recorded with a base CVSSv3.1 base score of 6.4 (LOCAL, HIGH complexity, HIGH privileges required) ...

CVE-2022-33986

CVE-2022-33986 concerns DMA attacks on the parameter buffer used by the InsydeH2O/VariableRuntimeDxe SMI handler, potentially enabling a TOCTOU attack and SMRAM corruption. Public sources specify the vulnerable component as the VariableRuntimeDxe driver’s SMI handler parameter buffer, with exploi...

CVE-2022-33985

The CVE-2022-33985 issue affects the NvmExpressDxe driver’s SMI input buffers. It enables a TOCTOU vulnerability that can lead to SMRAM corruption via DMA targeted at the SMI handler input buffers. The problem is fixed in kernel updates: 5.2 (05.27.25), 5.3 (05.36.25), 5.4 (05.44.25), and 5.5 (05...

CVE-2022-33905

DMA transactions which are targeted at input buffers used for the AhciBusDxe software SMI handler could cause SMRAM corruption a TOCTOU attack. DMA transactions which are targeted at input buffers used for the software SMI handler used by the AhciBusDxe driver could cause SMRAM corruption through...

CVE-2022-30773

DMA attacks on the parameter buffer used by the IhisiSmm driver could change the contents after parameter values have been checked but before they are used a TOCTOU attack. DMA attacks on the parameter buffer used by the IhisiSmm driver could change the contents after parameter values have been...

HP PC BIOS November 2022 Security Updates for Potential TOCTOU Vulnerabilities

Potential time-of-check to time-of-use TOCTOU vulnerabilities have been identified in the BIOS for certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure. HP is releasing BIOS updates to mitigate these potential...

Multiple race conditions due to TOCTOU flaws in various UEFI Implementations

Overview Multiple Unified Extensible Firmware Interface UEFI implementations are vulnerable to code execution in System Management Mode SMM by an attacker who gains administrative privileges on the local machine. An attacker can corrupt the memory using Direct Memory Access DMA timing attacks tha...