HIGH🇬🇧 English

CVE-2022-35408

CVSS 8.2v3.1pub. 2022-09-22upd. 2025-05-27

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An SMM callout vulnerability in the SMM driver in UsbLegacyControlSmm leads to possible arbitrary code execution in SMM and escalation of privileges. An attacker could overwrite the function pointers in the EFI_BOOT_SERVICES table before the USB SMI handler triggers. (This is not exploitable from code running in the operating system.)

oryginał EN
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

  • Insyde Insydeh2o

    APP
    Insyde
    5.1 – 5.17.38 (bez)5.2 – 05.27.28 (bez)5.3 – 05.36.28 (bez)5.4 – 05.44.28 (bez)5.5 – 05.52.28 (bez)5.0 – 05.09.38 (bez)
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
RCE
CWE
Referencje

Powiązane podatności

CVE-2023-39281CRITICAL9.8ten sam produkt

A stack buffer overflow vulnerability discovered in AsfSecureBootDxe in Insyde InsydeH2O with kernel 5.0 throu...

CVE-2021-41842CRITICAL9.8ten sam produkt

An issue was discovered in AtaLegacySmm in the kernel 5.0 before 05.08.46, 5.1 before 05.16.46, 5.2 before 05....

CVE-2024-55567HIGH7.5ten sam produkt

Improper input validation was discovered in UsbCoreDxe in Insyde InsydeH2O kernel 5.4 before 05.47.01, 5.5 bef...

CVE-2024-52878HIGH7.5ten sam produkt

An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.3...

CVE-2024-52877HIGH7.5ten sam produkt

An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.3...