CVE-2024-25078

A memory corruption vulnerability in StorageSecurityCommandDxe in Insyde InsydeH2O before kernel 5.2: IB19130163 in 05.29.07, kernel 5.3: IB19130163 in 05.38.07, kernel 5.4: IB19130163 in 05.46.07, kernel 5.5: IB19130163 in 05.54.07, and kernel 5.6: IB19130163 in 05.61.07 could lead to escalating privileges in SMM.

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 0.8 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://www.insyde.com/security-pledge	Vendor Advisory
https://www.insyde.com/security-pledge/SA-2024001	Vendor Advisory
https://www.insyde.com/security-pledge	Vendor Advisory
https://www.insyde.com/security-pledge/SA-2024001	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:o:insyde:kernel:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:insyde:kernel:*:*:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:o:insyde:kernel:*:*:*:*:*:*:*:*

Configuration 4 (hide)

cpe:2.3:o:insyde:kernel:*:*:*:*:*:*:*:*

Configuration 5 (hide)

cpe:2.3:o:insyde:kernel:*:*:*:*:*:*:*:*

History

29 Jul 2025, 20:02

Type	Values Removed	Values Added
First Time		Insyde Insyde kernel
References	~~() https://www.insyde.com/security-pledge -~~	() https://www.insyde.com/security-pledge - Vendor Advisory
References	~~() https://www.insyde.com/security-pledge/SA-2024001 -~~	() https://www.insyde.com/security-pledge/SA-2024001 - Vendor Advisory
CPE		cpe:2.3:o:insyde:kernel::::::::

21 Nov 2024, 09:00

Type	Values Removed	Values Added
References	~~() https://www.insyde.com/security-pledge -~~	() https://www.insyde.com/security-pledge -
References	~~() https://www.insyde.com/security-pledge/SA-2024001 -~~	() https://www.insyde.com/security-pledge/SA-2024001 -

03 Jul 2024, 01:48

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.4
Summary		(es) Una vulnerabilidad de corrupción de memoria en StorageSecurityCommandDxe en Insyde InsydeH2O antes del kernel 5.2: IB19130163 en 05.29.07, kernel 5.3: IB19130163 en 05.38.07, kernel 5.4: IB19130163 en 05.46.07, kernel IB191301 63 en 05.54.07 y kernel 5.6: IB19130163 del 61.05.07 podría provocar un aumento de privilegios en SMM.
CWE		CWE-822

15 May 2024, 14:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-05-15 14:15

Updated : 2025-07-29 20:02

NVD link : CVE-2024-25078

Mitre link : CVE-2024-25078

CVE.ORG link : CVE-2024-25078

JSON object : View

Products Affected

insyde

kernel

CWE

CWE-822

Untrusted Pointer Dereference

{"id": "CVE-2024-25078", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 0.8}]}, "published": "2024-05-15T14:15:08.250", "references": [{"url": "https://www.insyde.com/security-pledge", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.insyde.com/security-pledge/SA-2024001", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.insyde.com/security-pledge", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.insyde.com/security-pledge/SA-2024001", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-822"}]}], "descriptions": [{"lang": "en", "value": "A memory corruption vulnerability in StorageSecurityCommandDxe in Insyde InsydeH2O before kernel 5.2: IB19130163 in 05.29.07, kernel 5.3: IB19130163 in 05.38.07, kernel 5.4: IB19130163 in 05.46.07, kernel 5.5: IB19130163 in 05.54.07, and kernel 5.6: IB19130163 in 05.61.07 could lead to escalating privileges in SMM."}, {"lang": "es", "value": "Una vulnerabilidad de corrupci\u00f3n de memoria en StorageSecurityCommandDxe en Insyde InsydeH2O antes del kernel 5.2: IB19130163 en 05.29.07, kernel 5.3: IB19130163 en 05.38.07, kernel 5.4: IB19130163 en 05.46.07, kernel IB191301 63 en 05.54.07 y kernel 5.6: IB19130163 del 61.05.07 podr\u00eda provocar un aumento de privilegios en SMM."}], "lastModified": "2025-07-29T20:02:06.667", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:insyde:kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E5C18556-524B-4E5A-A2C1-A0DF8F139B6B", "versionEndExcluding": "5.29.07", "versionStartIncluding": "5.2"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:insyde:kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "21FDF4AF-8D94-477A-9CF3-1921AC95F108", "versionEndExcluding": "5.38.07", "versionStartIncluding": "5.3"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:insyde:kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "40002193-EEB0-422F-BB1E-8A78707640AB", "versionEndExcluding": "5.46.07", "versionStartIncluding": "5.4"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:insyde:kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "759DDEED-775C-45AC-8850-FEC17C7AD322", "versionEndExcluding": "5.54.07", "versionStartIncluding": "5.5"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:insyde:kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2BB86B48-B2DB-4CE9-A6FF-10081A1D377C", "versionEndExcluding": "5.61.07", "versionStartIncluding": "5.6"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}