CVE-2022-29276

SMI functions in AhciBusDxe use untrusted inputs leading to corruption of SMRAM. SMI functions in AhciBusDxe use untrusted inputs leading to corruption of SMRAM. This issue was discovered by Insyde during security review. It was fixed in: Kernel 5.0: version 05.09.18 Kernel 5.1: version 05.17.18 Kernel 5.2: version 05.27.18 Kernel 5.3: version 05.36.18 Kernel 5.4: version 05.44.18 Kernel 5.5: version 05.52.18 https://www.insyde.com/security-pledge/SA-2022059

CVSS v3 8.2 HIGH

8.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.5 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://www.insyde.com/security-pledge	Vendor Advisory
https://www.insyde.com/security-pledge/SA-2022059	Vendor Advisory
https://www.insyde.com/security-pledge	Vendor Advisory
https://www.insyde.com/security-pledge/SA-2022059	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:insyde:kernel::::::::
	cpe:2.3:o:insyde:kernel::::::::
	cpe:2.3:o:insyde:kernel::::::::
	cpe:2.3:o:insyde:kernel::::::::
	cpe:2.3:o:insyde:kernel::::::::
	cpe:2.3:o:insyde:kernel::::::::

History

21 Nov 2024, 06:58

Type	Values Removed	Values Added
References	~~() https://www.insyde.com/security-pledge - Vendor Advisory~~	() https://www.insyde.com/security-pledge - Vendor Advisory
References	~~() https://www.insyde.com/security-pledge/SA-2022059 - Vendor Advisory~~	() https://www.insyde.com/security-pledge/SA-2022059 - Vendor Advisory

29 Nov 2022, 14:28

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-11-15 22:15

Updated : 2025-04-30 15:15

NVD link : CVE-2022-29276

Mitre link : CVE-2022-29276

CVE.ORG link : CVE-2022-29276

JSON object : View

Products Affected

insyde

kernel

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2022-29276", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.5}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.5}]}, "published": "2022-11-15T22:15:10.087", "references": [{"url": "https://www.insyde.com/security-pledge", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.insyde.com/security-pledge/SA-2022059", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.insyde.com/security-pledge", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.insyde.com/security-pledge/SA-2022059", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "SMI functions in AhciBusDxe use untrusted inputs leading to corruption of SMRAM. SMI functions in AhciBusDxe use untrusted inputs leading to corruption of SMRAM. This issue was discovered by Insyde during security review. It was fixed in: Kernel 5.0: version 05.09.18 Kernel 5.1: version 05.17.18 Kernel 5.2: version 05.27.18 Kernel 5.3: version 05.36.18 Kernel 5.4: version 05.44.18 Kernel 5.5: version 05.52.18 https://www.insyde.com/security-pledge/SA-2022059"}, {"lang": "es", "value": "Las funciones SMI en AhciBusDxe utilizan entradas que no son de confianza, lo que provoca una corrupci\u00f3n de la SMRAM. Las funciones SMI en AhciBusDxe utilizan entradas que no son de confianza, lo que provoca corrupci\u00f3n de SMRAM. Insyde descubri\u00f3 este problema durante la revisi\u00f3n de seguridad. Se solucion\u00f3 en: \nKernel 5.0: versi\u00f3n 05.09.18 \nKernel 5.1: versi\u00f3n 05.17.18 \nKernel 5.2: versi\u00f3n 05.27.18 \nKernel 5.3: versi\u00f3n 05.36.18 \nKernel 5.4: versi\u00f3n 05.44.18 \nKernel 5.5: versi\u00f3n 05.52.18 \nhttps:/ /www.insyde.com/security-pledge/SA-2022059"}], "lastModified": "2025-04-30T15:15:52.360", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:insyde:kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BA3D7029-CF0B-403B-BAF9-2E010386B57E", "versionEndExcluding": "5.0.05.09.18", "versionStartIncluding": "5.0"}, {"criteria": "cpe:2.3:o:insyde:kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "715B9950-ABEB-4AF6-AA5B-74E6A7CB6B85", "versionEndExcluding": "5.1.05.17.18", "versionStartIncluding": "5.1"}, {"criteria": "cpe:2.3:o:insyde:kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2A36EE11-E18D-4114-87CF-F6EF71FB389C", "versionEndExcluding": "5.2.05.27.18", "versionStartIncluding": "5.2"}, {"criteria": "cpe:2.3:o:insyde:kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "185EB02B-3842-41FC-A16E-240462D00B5D", "versionEndExcluding": "5.3.05.36.18", "versionStartIncluding": "5.3"}, {"criteria": "cpe:2.3:o:insyde:kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E698B548-259B-48B2-96D4-693A31DCF394", "versionEndExcluding": "5.4.05.44.18", "versionStartIncluding": "5.4"}, {"criteria": "cpe:2.3:o:insyde:kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "19830B3D-E7CA-4989-8FBF-AB0D6A4E386D", "versionEndExcluding": "5.5.05.52.18", "versionStartIncluding": "5.5"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}