CVEvulnerability
CVE-2023-22614
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2023-04-11
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 8.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Weaknesses
- CWE-787
Description
An issue was discovered in ChipsetSvcSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. There is insufficient input validation in BIOS Guard updates. An attacker can induce memory corruption in SMM by supplying malformed inputs to the BIOS Guard SMI handler.
Affected configurations
• insyde insydeh2o 05.42.52.0026
• insyde insydeh2o 05.43.01.0026
• insyde insydeh2o 05.43.12.0056
• insyde insydeh2o 05.44.34.0054
• insyde insydeh2o 05.44.45.0015
• insyde insydeh2o 05.44.45.0028
Related
Weakness · CWE (1)
- CWE-787 Out-of-bounds Write weakness
References
- https://research.nccgroup.com/2023/04/11/stepping-insyde-system-management-mode/ Exploit, Third Party Advisory
- https://www.insyde.com/security-pledge Vendor Advisory
- https://www.insyde.com/security-pledge/SA-2023020 Vendor Advisory
- https://research.nccgroup.com/2023/04/11/stepping-insyde-system-management-mode/ Exploit, Third Party Advisory
- https://www.insyde.com/security-pledge Vendor Advisory
- https://www.insyde.com/security-pledge/SA-2023020 Vendor Advisory