PT-2024-20730 · Insyde · Insydeh2O

Published 2024-05-15 · Updated 2025-08-04 · CVE-2024-25079

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Insyde InsydeH2O kernel versions 5.2 through 5.2 before 05.29.09 Insyde InsydeH2O kernel versions 5.3 through 5.3 before 05.38.09 Insyde InsydeH2O kernel versions 5.4 through 5.4 before 05.46.09 Insyde InsydeH2O kernel versions 5.5 through 5.5 before 05.54.09 Insyde InsydeH2O kernel versions 5.6 through 5.6 before 05.61.09

Description A memory corruption vulnerability in HddPassword could lead to escalating privileges in SMM.

Recommendations For Insyde InsydeH2O kernel version 5.2 before 05.29.09, update to version 05.29.09 or later. For Insyde InsydeH2O kernel version 5.3 before 05.38.09, update to version 05.38.09 or later. For Insyde InsydeH2O kernel version 5.4 before 05.46.09, update to version 05.46.09 or later. For Insyde InsydeH2O kernel version 5.5 before 05.54.09, update to version 05.54.09 or later. For Insyde InsydeH2O kernel version 5.6 before 05.61.09, update to version 05.61.09 or later.

Fix

Weakness Enumeration

CWE-763

Related Identifiers

CVE-2024-25079

Affected Products

Insydeh2O

References · 6

• https://osv.dev/vulnerability/CVE-2024-25079 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-25079 · Security Note
• https://insyde.com/security-pledge/SA-2024001 · Vendor Advisory
• https://insyde.com/security-pledge · Vendor Advisory
• https://t.me/cvenotify/79848 · Telegram Post
• https://t.me/cveNotify/130753 · Telegram Post