CVEvulnerability
CVE-2023-39283
7.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2023-11-02
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-787
Description
An SMM memory corruption vulnerability in the SMM driver (SMRAM write) in CsmInt10HookSmm in Insyde InsydeH2O with kernel 5.0 through 5.5 allows attackers to send arbitrary data to SMM which could lead to privilege escalation.
Affected configurations
• insyde insydeh2o (>= 5.0 <= 5.5)
• insyde insydeh2o 5.5.05.53.22
• insyde insydeh2o 5.6
• insyde insydeh2o 5.6.05.60.22
Related
Weakness · CWE (1)
- CWE-787 Out-of-bounds Write weakness
References
- https://www.insyde.com/security-pledge Not Applicable
- https://www.insyde.com/security-pledge/SA-2023055 Vendor Advisory
- https://www.insyde.com/security-pledge Not Applicable
- https://www.insyde.com/security-pledge/SA-2023055 Vendor Advisory