PT-2025-17632 · Insyde · Insydeh2O

Published 2025-04-23 · Updated 2025-08-15 · CVE-2024-52879

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Insyde InsydeH2O kernel versions 5.2 through 5.7 before version 05.70.50

Description: An issue was discovered in the InsydeH2O kernel, where the SmmUpdateVariablePropertySmi() function, a SMM callback function in the VariableRuntimeDxe driver, uses StrCmp() to compare variable names. This action may cause a buffer over-read.

Recommendations: For Insyde InsydeH2O kernel versions 5.2 through 5.7 before version 05.70.50, update to version 05.70.50 or later to resolve the issue. As a temporary workaround, consider restricting access to the VariableRuntimeDxe driver until a patch is available.

Fix

Buffer Over-read

Weakness Enumeration

CWE-126

Related Identifiers

CVE-2024-52879

Affected Products

Insydeh2O

References · 11

• https://insyde.com/security-pledge · Vendor Advisory
• https://insyde.com/security-pledge/sa-2024016 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-52879 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-52879 · Security Note
• https://t.me/cveNotify/132475 · Telegram Post
• https://reddit.com/r/YogaPro9i/comments/1k5xhor/new_bios_update_yoga_pro_9i_gen_9_nkcn31ww · Reddit Post
• https://t.me/cvetracker/23910 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1923081674427965827 · Twitter Post
• https://reddit.com/r/LenovoLegion/comments/1lkamec/legion_pro_7i_gen_9_16irx9h_june_25_bios_n2cn27ww · Reddit Post
• https://t.me/cvenotify/123003 · Telegram Post
• https://reddit.com/r/LenovoLegion/comments/1ldkkdk/new_gen8_bios_kwcn50ww_with_intel_microcode_0x12e · Reddit Post