PT-2022-25303 · Sbpei · Sbpei

Published 2022-09-20 · Updated 2022-09-26 · CVE-2022-40246

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:P/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SbPei (affected versions not specified)

Description A potential attacker can write one byte by arbitrary address at the time of the PEI phase, only during S3 resume boot mode, and influence the subsequent boot stages. This can lead to mitigations bypassing, physical memory contents disclosure, discovery of secrets from Virtual Machines (VMs), and bypassing memory isolation and confidential computing boundaries. An attacker can also build a payload to be injected into the SMRAM memory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Weakness Enumeration

CWE-787

CWE-123

Related Identifiers

CVE-2022-40246

Affected Products

Sbpei

References · 5

• 🔥 https://binarly.io/advisories/BRLY-2022-014 · Exploit
• https://osv.dev/vulnerability/CVE-2022-40246 · Vendor Advisory
• https://ami.com/security-center · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-40246 · Security Note
• https://t.me/cibsecurity/50160 · Telegram Post