An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. It is possible to write to an attacker-controlled address. An attacker could invoke an SMI handler with a malformed pointer in RCX that overlaps SMRAM, resulting in SMM memory corruption.
References
| Link | Resource |
|---|---|
| https://research.nccgroup.com/2023/04/11/stepping-insyde-system-management-mode/ | Not Applicable |
| https://www.insyde.com/security-pledge | Vendor Advisory |
| https://www.insyde.com/security-pledge/SA-2023023 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
14 Aug 2023, 18:21
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:insyde:insydeh20:05.44.45:*:*:*:*:*:*:* cpe:2.3:a:insyde:insydeh20:05.27.37:*:*:*:*:*:*:* cpe:2.3:a:insyde:insydeh20:05.36.37:*:*:*:*:*:*:* |
cpe:2.3:a:insyde:insydeh2o:05.52.45:*:*:*:*:*:*:* cpe:2.3:a:insyde:insydeh2o:05.44.45:*:*:*:*:*:*:* cpe:2.3:a:insyde:insydeh2o:05.36.37:*:*:*:*:*:*:* cpe:2.3:a:insyde:insydeh2o:05.27.37:*:*:*:*:*:*:* |
26 Apr 2023, 14:02
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-04-11 22:15
Updated : 2024-02-04 23:37
NVD link : CVE-2023-22613
Mitre link : CVE-2023-22613
CVE.ORG link : CVE-2023-22613
JSON object : View
Products Affected
insyde
- insydeh2o
CWE
CWE-787
Out-of-bounds Write