Insyde InsydeH2O Security Breach

Insyde InsydeH2O is a C-language source from Insyde Corporation of Taiwan, which implements the new technology "EFI/UEFI" specification designed to replace the traditional BIOS Basic Input/Output System. A security vulnerability exists in Insyde InsydeH2O with kernel versions 5.0 through 5.5, whi...

CVE-2023-39281

A stack buffer overflow vulnerability discovered in AsfSecureBootDxe in Insyde InsydeH2O with kernel 5.0 through 5.5 allows attackers to run arbitrary code execution during the DXE phase...

AMD Client UEFI DXE Driver Memory Leaks September 2023 Security Update

AMD has informed HP of potential vulnerabilities identified in some AMD client platform firmware components, which might allow denial of service or information disclosure. AMD is releasing firmware updates to mitigate these vulnerabilities. AMD has released updates to mitigate the potential...

CVE-2023-20597

Improper initialization of variables in the DXE driver may allow a privileged user to leak sensitive information via local access...

CVE-2023-20594

Improper initialization of variables in the DXE driver may allow a privileged user to leak sensitive information via local access...

CVE-2023-20594

Improper initialization of variables in the DXE driver may allow a privileged user to leak sensitive information via local access...

CVE-2023-20597

Improper initialization of variables in the DXE driver may allow a privileged user to leak sensitive information via local access...

Input validation

Improper initialization of variables in the DXE driver may allow a privileged user to leak sensitive information via local access...

Input validation

Improper initialization of variables in the DXE driver may allow a privileged user to leak sensitive information via local access...

CVE-2023-20597

CVE-2023-20597 concerns improper initialization of variables in the AMD DXE driver, leading to potential local-information disclosure. The vulnerability is discussed across multiple sources (AMD/SB-4007 and related advisories), which describe memory-leak risks in the DXE driver and note mitigatio...

CVE-2023-20597

Improper initialization of variables in the DXE driver may allow a privileged user to leak sensitive information via local access...

CVE-2023-20594

CVE-2023-20594 concerns the AMD DXE driver. The root cause is improper initialization of variables in the DXE driver, which may allow a privileged local user to leak sensitive information. Impact is information disclosure with local access; attack vector is local. The vulnerability affects AMD DX...

CVE-2023-20594

Improper initialization of variables in the DXE driver may allow a privileged user to leak sensitive information via local access...

CVE-2023-20597: Access of Uninitialized Pointer

Improper initialization of variables in the DXE driver may allow a privileged user to leak sensitive information via local access...

CVE-2023-20594: Access of Uninitialized Pointer

Improper initialization of variables in the DXE driver may allow a privileged user to leak sensitive information via local access...

DXE Driver Memory Leaks

Bulletin ID: AMD-SB-4007 Potential Impact: Data Leakage Severity: Medium Summary Potential memory leak vulnerabilities in AMD Driver Execution Environment DXE driver. CVE Details Refer to Glossary for explanation of terms CVE| Severity| Description ---|---|--- CVE-2023-20594| Medium| Improper...

HPESBHF04541 rev.1 - Certain HPE ProLiant AMD XL Servers Using AMD EPYC Processors, AMD-SB-4007, DXE Driver Memory Leaks, Local Disclosure of Sensitive Information

Potential Security Impact: Local: Disclosure of Sensitive Information SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE ProLiant XL675d Gen10 Plus Server - Prior to v2.6411-30-2022 HPE ProLiant XL645d Gen10 Plus Server - Prior to v2.6411-30-2022 HPE ProLiant XL225n Gen10 Plus 1U...

HPESBHF04537 rev.1 - Certain HPE ProLiant AMD DL Servers Using AMD EPYC Processors, AMD-SB-4007, DXE Driver Memory Leaks, Local Disclosure of Sensitive Information

Potential Security Impact: Local: Disclosure of Sensitive Information SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE ProLiant DL325 Gen10 Plus v2 server - Prior to v2.6411-17-2022 HPE ProLiant DL345 Gen10 Plus server - Prior to v2.6411-17-2022 HPE ProLiant DL365 Gen10 Plus...

PT-2023-17473 · Amd · Amd Epyc™ Embedded 7003 +77

Name of the Vulnerable Software and Affected Versions: Insufficient information is provided to determine the specific software and versions affected. Description: The issue involves improper initialization of variables in the DXE driver, which may allow a privileged user to leak sensitive...

CVE-2023-34195

An issue was discovered in SystemFirmwareManagementRuntimeDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. The implementation of the GetImage method retrieves the value of a runtime variable named GetImageProgress, and later uses this value as a function pointer. This variable is wiped out by...