PT-2022-19518 · Insyde · Nvmexpressdxe

Published 2022-11-15 · Updated 2022-11-29 · CVE-2022-29278

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NvmExpressDxe driver versions prior to 05.17.23 NvmExpressDxe driver versions prior to 05.27.23 NvmExpressDxe driver versions prior to 05.36.23 NvmExpressDxe driver versions prior to 05.44.23 NvmExpressDxe driver versions prior to 05.52.23

Description Incorrect pointer checks within the NvmExpressDxe driver can allow tampering with SMRAM and OS memory. This issue was discovered by Insyde during security review.

Recommendations For Kernel 5.1, update to Version 05.17.23 or later. For Kernel 5.2, update to Version 05.27.23 or later. For Kernel 5.3, update to Version 05.36.23 or later. For Kernel 5.4, update to Version 05.44.23 or later. For Kernel 5.5, update to Version 05.52.23 or later.

Fix

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

CVE-2022-29278

Affected Products

Nvmexpressdxe

References · 5

• https://osv.dev/vulnerability/CVE-2022-29278 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29278 · Security Note
• https://insyde.com/security-pledge/SA-2022061 · Vendor Advisory
• https://insyde.com/security-pledge · Vendor Advisory
• https://t.me/cvenotify/37829 · Telegram Post