CVEvulnerability
CVE-2023-22616
7.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2023-04-12
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-610
Description
An issue was discovered in Insyde InsydeH2O with kernel 5.2 through 5.5. The Save State register is not checked before use. The IhisiSmm driver does not check the value of a save state register before use. Due to insufficient input validation, an attacker can corrupt SMRAM.
Affected configurations
• insyde insydeh2o (>= 5.2 <= 5.5)
Related
Weakness · CWE (1)
- CWE-610 Externally Controlled Reference to a Resource in Another Sphere weakness
References
- https://research.nccgroup.com/2023/04/11/stepping-insyde-system-management-mode/ Exploit, Third Party Advisory
- https://www.insyde.com/security-pledge Vendor Advisory
- https://www.insyde.com/security-pledge/SA-2023022 Vendor Advisory
- https://research.nccgroup.com/2023/04/11/stepping-insyde-system-management-mode/ Exploit, Third Party Advisory
- https://www.insyde.com/security-pledge Vendor Advisory
- https://www.insyde.com/security-pledge/SA-2023022 Vendor Advisory