CVEvulnerability
CVE-2023-39284
5.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2023-11-02
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Description
An issue was discovered in IhisiServicesSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. There are arbitrary calls to SetVariable with unsanitized arguments in the SMI handler.
Affected configurations
• insyde insydeh2o (>= 5.2 < 5.2.05.28.33)
• insyde insydeh2o (>= 5.3 < 5.3.05.37.33)
• insyde insydeh2o (>= 5.4 < 5.4.05.45.33)
• insyde insydeh2o (>= 5.5 < 5.5.05.53.33)
• insyde insydeh2o (>= 5.6 < 5.6.05.60.33)
References
- https://www.insyde.com/security-pledge Vendor Advisory
- https://www.insyde.com/security-pledge/SA-2023056 Vendor Advisory
- https://www.insyde.com/security-pledge Vendor Advisory
- https://www.insyde.com/security-pledge/SA-2023056 Vendor Advisory