VulnCheck KEV: CVE-2023-40238

A LogoFAIL issue was discovered in BmpDecoderDxe in Insyde InsydeH2O with kernel 5.2 before 05.28.47, 5.3 before 05.37.47, 5.4 before 05.45.47, 5.5 before 05.53.47, and 5.6 before 05.60.47 for certain Lenovo devices. Image parsing of crafted BMP logo files can copy data to a specific address duri...

CVE-2023-40238

creationtimestamp| type| source ---|---|--- 2023-12-11 10:24:17+00:00| exploited| https://t.me/cultofwire/1146 2023-12-30 10:36:41+00:00| seen| https://t.me/ctinow/160847 2024-01-05 18:31:37+00:00| seen| https://t.me/ctinow/163626 2024-12-03 11:01:07+00:00| seen|...

CVE-2023-40238

A LogoFAIL vulnerability exists in the BmpDecoderDxe component of the InsydeH2O UEFI firmware development framework. The issue stems from an integer signedness error involving PixelHeight and PixelWidth during RLE4/RLE8 compression , which allows an attacker to copy data to a specific address dur...

CVE-2023-40238

A LogoFAIL issue was discovered in BmpDecoderDxe in Insyde InsydeH2O with kernel 5.2 before 05.28.47, 5.3 before 05.37.47, 5.4 before 05.45.47, 5.5 before 05.53.47, and 5.6 before 05.60.47 for certain Lenovo devices. Image parsing of crafted BMP logo files can copy data to a specific address duri...

Image files in UEFI can be abused to modify boot behavior

Overview Implementation of Unified Extensible Firmware Interface UEFI by Vendors provide a way to customize logo image displayed during the early boot phase. Binarly has uncovered vulnerabilities in the image parsing libraries that provide this capability. An attacker with local privileged access...