653 matches found
Code injection
A potential vulnerability was reported in the SMI callback function of the OemSmi driver that may allow a local attacker with elevated permissions to execute arbitrary code...
CVE-2023-43570
A potential vulnerability was reported in the SMI callback function of the OemSmi driver that may allow a local attacker with elevated permissions to execute arbitrary code...
CVE-2023-43570
A potential vulnerability was reported in the SMI callback function of the OemSmi driver that may allow a local attacker with elevated permissions to execute arbitrary code...
CVE-2023-43570
The CVE-2023-43570 entry involves the OemSmi driver, specifically its SMI callback function, where a local attacker with elevated privileges could execute arbitrary code. Documents consistently identify the vulnerable component as the OemSmi driver’s SMI callback, indicating local privilege escal...
CVE-2023-39284
An issue was discovered in IhisiServicesSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. There are arbitrary calls to SetVariable with unsanitized arguments in the SMI handler...
CVE-2023-39284
An issue was discovered in IhisiServicesSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. There are arbitrary calls to SetVariable with unsanitized arguments in the SMI handler...
Design/Logic Flaw
An issue was discovered in IhisiServicesSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. There are arbitrary calls to SetVariable with unsanitized arguments in the SMI handler...
CVE-2023-39284
An issue was discovered in IhisiServicesSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. There are arbitrary calls to SetVariable with unsanitized arguments in the SMI handler...
CVE-2023-39284
An issue was discovered in IhisiServicesSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. There are arbitrary calls to SetVariable with unsanitized arguments in the SMI handler...
CVE-2023-39284
CVE-2023-39284 affects Insyde InsydeH2O kernel 5.0–5.5 via IhisiServicesSmm, where arbitrary SetVariable calls in the SMI handler can pass attacker-controlled parameters. Root cause: unsanitized arguments in SMI SetVariable handling, enabling modification of protected NVRAM variables from Ring0 (...
CVE-2022-4574
An SMI handler input validation vulnerability in the BIOS of some ThinkPad models could allow an attacker with local access and elevated privileges to execute arbitrary code...
CVE-2022-4573
An SMI handler input validation vulnerability in the ThinkPad X1 Fold Gen 1 could allow an attacker with local access and elevated privileges to execute arbitrary code...
Input validation
An SMI handler input validation vulnerability in the BIOS of some ThinkPad models could allow an attacker with local access and elevated privileges to execute arbitrary code...
CVE-2022-4574
The CVE describes a BIOS SMI handler input validation vulnerability in Lenovo ThinkPad models. A local, elevated-privilege attacker could exploit a flaw in the SMI handler to execute arbitrary code. The available documents identify the affected surface as the BIOS/SMI handler but do not specify e...
CVE-2022-4574
An SMI handler input validation vulnerability in the BIOS of some ThinkPad models could allow an attacker with local access and elevated privileges to execute arbitrary code...
CVE-2022-4574
An SMI handler input validation vulnerability in the BIOS of some ThinkPad models could allow an attacker with local access and elevated privileges to execute arbitrary code...
CVE-2022-4573
An SMI handler input validation vulnerability in the ThinkPad X1 Fold Gen 1 could allow an attacker with local access and elevated privileges to execute arbitrary code...
CVE-2022-4573
Summary: CVE-2022-4573 is described across multiple sources as an input-validation flaw in the SMI handler of the ThinkPad X1 Fold Gen 1 BIOS firmware. The vulnerability could allow a local, high-privilege attacker to execute arbitrary code due to improper validation in the SMI handler. Affected ...
CVE-2022-4573
An SMI handler input validation vulnerability in the ThinkPad X1 Fold Gen 1 could allow an attacker with local access and elevated privileges to execute arbitrary code...
Lenovo ThinkPad Input Validation Error Vulnerability
Lenovo ThinkPad is a portable computer from Lenovo, a Chinese company. The Lenovo ThinkPad X1 Fold Gen 1 suffers from an input validation error vulnerability that stems from a security issue in the SMI handler that could allow an attacker with local access and elevated privileges to execute...