CVEvulnerability
CVE-2022-36338
8.2 HIGH
Official page ↗
- Status
- Modified
- Published
- 2022-09-23
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.2 HIGH — CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 8.2 HIGH — CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Description
An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An SMM callout vulnerability in the SMM driver FwBlockServiceSmm, creating SMM, leads to arbitrary code execution. An attacker can replace the pointer to the UEFI boot service GetVariable with a pointer to malware, and then generate a software SMI.
Affected configurations
• insyde insydeh2o (>= 5.0 <= 5.5)
References
- https://binarly.io/advisories/BRLY-2022-017/index.html Exploit, Third Party Advisory
- https://www.insyde.com/security-pledge Vendor Advisory
- https://www.insyde.com/security-pledge/SA-2022029 Vendor Advisory
- https://binarly.io/advisories/BRLY-2022-017/index.html Exploit, Third Party Advisory
- https://www.insyde.com/security-pledge Vendor Advisory
- https://www.insyde.com/security-pledge/SA-2022029 Vendor Advisory