PT-2022-23002 · Insyde · Insydeh2O

Published 2022-09-22 · Updated 2022-09-26 · CVE-2022-35894

Positive Technologies (AI Summary)

CVSS v3.1

6.0

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Insyde InsydeH2O with kernel versions 5.0 through 5.5

Description An issue was discovered where the SMI handler for the FwBlockServiceSmm driver uses an untrusted pointer as the location to copy data to an attacker-specified buffer, leading to information disclosure.

Recommendations For Insyde InsydeH2O with kernel versions 5.0 through 5.5, at the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

CVE-2022-35894

Affected Products

Insydeh2O

References · 5

• 🔥 https://binarly.io/advisories/BRLY-2022-018/index.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-35894 · Security Note
• https://insyde.com/security-pledge/SA-2022030 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-35894 · Vendor Advisory
• https://insyde.com/security-pledge · Vendor Advisory