CVE-2024-52878

An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel 5.5 before version 05.54.50, kernel 5.6 before version 05.61.50, and kernel 5.7 before version 05.70.50. In VariableRuntimeDxe driver,...

CVE-2024-52878

The CVE-2024-52878 affects Insyde InsydeH2O kernel (VariableRuntimeDxe driver). The vulnerable component is VariableServicesSetVariable(), which reads variable name size/length with StrSize/StrLen and compares with StrCmp, potentially causing a buffer over-read. Affected versions include 5.2–05.2...