CVE-2022-34325: Time-of-check Time-of-use (TOCTOU) Race Condition

DMA transactions which are targeted at input buffers used for the StorageSecurityCommandDxe software SMI handler could cause SMRAM corruption through a TOCTOU attack. DMA transactions which are targeted at input buffers used for the software SMI handler used by the StorageSecurityCommandDxe drive...

CVE-2022-34325

DMA transactions which are targeted at input buffers used for the StorageSecurityCommandDxe software SMI handler could cause SMRAM corruption through a TOCTOU attack. DMA transactions which are targeted at input buffers used for the software SMI handler used by the StorageSecurityCommandDxe drive...

PT-2022-22131 · Insyde · Insydeh2O Uefi Firmware

Name of the Vulnerable Software and Affected Versions: InsydeH2O UEFI firmware affected versions not specified Description: The issue concerns DMA transactions targeted at input buffers used for the StorageSecurityCommandDxe software SMI handler, which could cause SMRAM corruption through a TOCTO...

CVE-2022-34325

DMA transactions which are targeted at input buffers used for the StorageSecurityCommandDxe software SMI handler could cause SMRAM corruption through a TOCTOU attack. DMA transactions which are targeted at input buffers used for the software SMI handler used by the StorageSecurityCommandDxe drive...

CVE-2022-34325

CVE-2022-34325 affects InsydeH2O StorageSecurityCommandDxe in UEFI BIOS/firmware. The issue is a TOCTOU race condition where DMA transactions targeting input buffers used by the StorageSecurityCommandDxe SMI handler can lead to SMRAM corruption. Affected component appears to be the StorageSecurit...

CVE-2021-42113

StorageSecurityCommandDxe in InsydeH2O firmware (Kernel 5.1 before 05.14.28, Kernel 5.2 before 05.24.28, Kernel 5.3 before 05.32.25) contains an SMM callout vulnerability that can hijack execution flow in System Management Mode and escalate privileges to SMM. The issue is fixed in InsydeH2O kerne...

Memory corruption

An issue was discovered in Insyde InsydeH2O with kernel 5.1 through 2021-11-08, 5.2 through 2021-11-08, and 5.3 through 2021-11-08. A StorageSecurityCommandDxe SMM memory corruption vulnerability allows an attacker to write fixed or predictable data to SMRAM. Exploiting this issue could lead to...

PT-2022-11543

Name of the Vulnerable Software and Affected Versions Insyde InsydeH2O with Kernel 5.1 before 05.14.28 Insyde InsydeH2O with Kernel 5.2 before 05.24.28 Insyde InsydeH2O with Kernel 5.3 before 05.32.25 Description An issue was discovered in StorageSecurityCommandDxe, allowing an attacker to hijack...

CVE-2021-43522: Out-of-bounds Write

An issue was discovered in Insyde InsydeH2O with kernel 5.1 through 2021-11-08, 5.2 through 2021-11-08, and 5.3 through 2021-11-08. A StorageSecurityCommandDxe SMM memory corruption vulnerability allows an attacker to write fixed or predictable data to SMRAM. Exploiting this issue could lead to...

CVE-2021-42113: Undefined Security Weakness

An issue was discovered in StorageSecurityCommandDxe in Insyde InsydeH2O with Kernel 5.1 before 05.14.28, Kernel 5.2 before 05.24.28, and Kernel 5.3 before 05.32.25. An SMM callout vulnerability allows an attacker to hijack execution flow of code running in System Management Mode. Exploiting this...

PT-2022-11868

Name of the Vulnerable Software and Affected Versions InsydeH2O kernel versions 5.1 through 2021-11-08 InsydeH2O kernel versions 5.2 through 2021-11-08 InsydeH2O kernel versions 5.3 through 2021-11-08 Description An issue in InsydeH2O allows an attacker to write fixed or predictable data to SMRAM...