Siemens InsydeH2O Arbitrary Code Execution (CVE-2022-35408)

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An SMM callout vulnerability in the SMM driver in UsbLegacyControlSmm leads to possible arbitrary code execution in SMM and escalation of privileges. An attacker could overwrite the function pointers in the EFIBOOTSERVICES...

Code injection

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An SMM callout vulnerability in the SMM driver in UsbLegacyControlSmm leads to possible arbitrary code execution in SMM and escalation of privileges. An attacker could overwrite the function pointers in the EFIBOOTSERVICES...

CVE-2022-35408

CVE-2022-35408 affects Insyde InsydeH2O BIOS (versions 5.0–5.5). A vulnerability in the UsbLegacyControlSmm SMM driver enables arbitrary code execution in SMM and privilege escalation by overwriting EFI_BOOT_SERVICES pointers before the USB SMI handler runs; this is not exploitable from OS code. ...