PT-2025-17630 · Insyde · Insydeh2O

Published

2025-04-23

·

Updated

2025-08-15

·

CVE-2024-52877

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions: Insyde InsydeH2O kernel versions 5.2 through 05.29.49 Insyde InsydeH2O kernel versions 5.3 through 05.38.49 Insyde InsydeH2O kernel versions 5.4 through 05.46.49 Insyde InsydeH2O kernel versions 5.5 through 05.54.49 Insyde InsydeH2O kernel versions 5.6 through 05.61.49 Insyde InsydeH2O kernel versions 5.7 through 05.70.49
Description: A buffer over-read issue was discovered in the VariableRuntimeDxe driver. The SmmCreateVariableLockList() callback function calls CreateVariableLockListInSmm(), which uses StrSize() to get the variable name size. This could lead to a buffer over-read.
Recommendations: For Insyde InsydeH2O kernel versions 5.2 through 05.29.49, update to version 05.29.50 or later. For Insyde InsydeH2O kernel versions 5.3 through 05.38.49, update to version 05.38.50 or later. For Insyde InsydeH2O kernel versions 5.4 through 05.46.49, update to version 05.46.50 or later. For Insyde InsydeH2O kernel versions 5.5 through 05.54.49, update to version 05.54.50 or later. For Insyde InsydeH2O kernel versions 5.6 through 05.61.49, update to version 05.61.50 or later. For Insyde InsydeH2O kernel versions 5.7 through 05.70.49, update to version 05.70.50 or later.

Fix

Buffer Over-read

Weakness Enumeration

CWE-126

Related Identifiers

CVE-2024-52877

Affected Products

Insydeh2O