CVE-2024-52877

A buffer over-read vulnerability exists in the Insyde InsydeH2O kernel within the VariableRuntimeDxe driver. The issue occurs because the callback function SmmCreateVariableLockList() calls CreateVariableLockListInSmm(), which incorrectly uses StrSize() to determine the size of a variable name. T...