PT-2022-25306 · Unknown · Overclocksmihandler

Published 2022-09-20 · Updated 2022-09-26 · CVE-2022-40261

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OverClockSmiHandler (affected versions not specified)

Description An attacker can exploit this issue to elevate privileges from ring 0 to ring -2, execute arbitrary code in System Management Mode - an environment more privileged than the operating system (OS) and completely isolated from it. Running arbitrary code in SMM additionally bypasses SMM-based SPI flash protections against modifications, which can help an attacker to install a firmware backdoor/implant into BIOS. Such malicious firmware code in BIOS could persist across operating system re-installs. This issue potentially could be used by malicious actors to bypass security mechanisms provided by UEFI firmware, such as Secure Boot and some types of memory isolation for hypervisors.

Recommendations At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2022-40261

Affected Products

Overclocksmihandler

References · 5

• 🔥 https://binarly.io/advisories/BRLY-2022-003 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-40261 · Security Note
• https://ami.com/security-center · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-40261 · Vendor Advisory
• https://t.me/cibsecurity/50162 · Telegram Post