PT-2023-21149 · Insyde · Insydeh2O

Published 2023-08-18 · Updated 2023-08-24 · CVE-2023-27471

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Insyde InsydeH2O with kernel 5.0 through 5.5

Description An issue was discovered in Insyde InsydeH2O where UEFI implementations do not correctly protect and validate information contained in the MeSetup UEFI variable. On some systems, this variable can be overwritten using operating system APIs. Exploitation of this issue could potentially lead to denial of service for the platform.

Recommendations For Insyde InsydeH2O with kernel 5.0 through 5.5, consider restricting access to the MeSetup UEFI variable to minimize the risk of exploitation. As a temporary workaround, avoid using operating system APIs that can overwrite this variable until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Related Identifiers

CVE-2023-27471

Affected Products

Insydeh2O

References · 7

• https://insyde.com/security-pledge/SA-2023036 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-27471 · Security Note
• https://osv.dev/vulnerability/CVE-2023-27471 · Vendor Advisory
• https://t.me/cibsecurity/68842 · Telegram Post
• https://t.me/cvenotify/56893 · Telegram Post
• https://t.me/cvenotify/57177 · Telegram Post
• https://t.me/cvenotify/56863 · Telegram Post