Insyde · Insydeh2O · CVE-2023-22616
**Name of the Vulnerable Software and Affected Versions**
Insyde InsydeH2O versions 5.2 through 5.5
**Description**
An issue was discovered in Insyde InsydeH2O where the Save State register is not checked before use. The IhisiSmm driver does not check the value of a save state register before use. Due to insufficient input validation, an attacker can corrupt SMRAM.
**Recommendations**
For versions 5.2 through 5.5, as a temporary workaround, consider restricting access to the IhisiSmm driver until a patch is available. Additionally, avoid using the Save State register in sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.