PT-2023-12745 · Insyde · Insydeh2O

Published 2023-04-12 · Updated 2025-03-19 · CVE-2022-24350

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Insyde InsydeH2O versions 5.0 through 5.5

Description An issue was discovered in IhisiSmm where the IHISI function 0x17 does not verify that output data does not go beyond the end of the command buffer. This could lead to possible circumstances where the data immediately following the command buffer could be destroyed before returning a buffer size error. Specially formatted buffer contents used for software SMI could cause SMRAM corruption, leading to escalation of privilege.

Recommendations For versions 5.0 through 5.5, as a temporary workaround, consider restricting access to the IHISI function 0x17 until a patch is available. Additionally, avoid using specially formatted buffer contents for software SMI to minimize the risk of SMRAM corruption. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2022-24350

Affected Products

Insydeh2O

References · 7

• https://osv.dev/vulnerability/CVE-2022-24350 · Vendor Advisory
• https://insyde.com/security-pledge/SA-2023027 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24350 · Security Note
• https://insyde.com/security-pledge · Vendor Advisory
• https://t.me/cibsecurity/61971 · Telegram Post
• https://t.me/cvenotify/48113 · Telegram Post
• https://t.me/cvenotify/115370 · Telegram Post