PT-2024-13431 · Insyde · Insydeh2O

Published 2024-04-26 · Updated 2025-07-29 · CVE-2023-47252

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Insyde InsydeH2O kernel versions 5.0 through 5.6

Description An issue was discovered in PnpSmm, where there is a possible out-of-bounds access in the SMM communication buffer, leading to tampering. The PNP-related SMI sub-functions do not verify data size before getting it from the communication buffer, which could lead to possible circumstances where the data immediately following the command buffer could be destroyed with a fixed value.

Recommendations For kernel 5.0, update to kernel 5.2 v05.28.45 or later. For kernel 5.1, update to kernel 5.2 v05.28.45 or later. For kernel 5.2, update to kernel 5.2 v05.28.45 or later. For kernel 5.3, update to kernel 5.3 v05.37.45 or later. For kernel 5.4, update to kernel 5.4 v05.45.45 or later. For kernel 5.5, update to kernel 5.5 v05.53.45 or later. For kernel 5.6, update to kernel 5.6 v05.60.45 or later.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2023-47252

Affected Products

Insydeh2O

References · 5

• https://insyde.com/security-pledge/SA-2023067 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-47252 · Security Note
• https://osv.dev/vulnerability/CVE-2023-47252 · Vendor Advisory
• https://t.me/cvenotify/78077 · Telegram Post
• https://t.me/cveNotify/130200 · Telegram Post