CVE-2023-22613

CVE-2023-22613 concerns InsydeH2O’s IhisiSmm on kernel 5.0–5.5, where an attacker can cause SMM memory corruption by writing to an attacker-controlled address. The root cause is a malformed pointer in RCX that overlaps SMRAM when invoking an SMI handler, enabling a potential out-of-bounds write. ...