CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 1CVE-2023-40238
https://notcve.org/view.php?id=CVE-2023-40238
07 Dec 2023 — A LogoFAIL issue was discovered in BmpDecoderDxe in Insyde InsydeH2O with kernel 5.2 before 05.28.47, 5.3 before 05.37.47, 5.4 before 05.45.47, 5.5 before 05.53.47, and 5.6 before 05.60.47 for certain Lenovo devices. Image parsing of crafted BMP logo files can copy data to a specific address during the DXE phase of UEFI execution. This occurs because of an integer signedness error involving PixelHeight and PixelWidth during RLE4/RLE8 compression. Se descubrió un problema de LogoFAIL en BmpDecoderDxe en Insy... • https://binarly.io/posts/finding_logofail_the_dangers_of_image_parsing_during_system_boot/index.html • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2023-39283
https://notcve.org/view.php?id=CVE-2023-39283
02 Nov 2023 — An SMM memory corruption vulnerability in the SMM driver (SMRAM write) in CsmInt10HookSmm in Insyde InsydeH2O with kernel 5.0 through 5.5 allows attackers to send arbitrary data to SMM which could lead to privilege escalation. Una vulnerabilidad de corrupción de memoria SMM en el controlador SMM (SMRAM write) en CsmInt10HookSmm en Insyde InsydeH2O con kernel 5.0 a 5.5 permite a atacantes enviar datos arbitrarios a SMM, lo que podría conducir a una escalada de privilegios. • https://www.insyde.com/security-pledge • CWE-787: Out-of-bounds Write •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2023-39284
https://notcve.org/view.php?id=CVE-2023-39284
02 Nov 2023 — An issue was discovered in IhisiServicesSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. There are arbitrary calls to SetVariable with unsanitized arguments in the SMI handler. Se descubrió un problema en IhisiServicesSmm en Insyde InsydeH2O con kernel 5.0 a 5.5. Hay llamadas arbitrarias a SetVariable con argumentos no sanitizados en el controlador SMI. • https://www.insyde.com/security-pledge •
CVSS: 5.3EPSS: 0%CPEs: 5EXPL: 0CVE-2023-30633
https://notcve.org/view.php?id=CVE-2023-30633
19 Oct 2023 — An issue was discovered in TrEEConfigDriver in Insyde InsydeH2O with kernel 5.0 through 5.5. It can report false TPM PCR values, and thus mask malware activity. Devices use Platform Configuration Registers (PCRs) to record information about device and software configuration to ensure that the boot process is secure. (For example, Windows uses these PCR measurements to determine device health.) A vulnerable device can masquerade as a healthy device by extending arbitrary values into Platform Configuration Re... • https://www.insyde.com/security-pledge •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2023-34195
https://notcve.org/view.php?id=CVE-2023-34195
18 Sep 2023 — An issue was discovered in SystemFirmwareManagementRuntimeDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. The implementation of the GetImage method retrieves the value of a runtime variable named GetImageProgress, and later uses this value as a function pointer. This variable is wiped out by the same module near the end of the function. By setting this UEFI variable from the OS to point into custom code, an attacker could achieve arbitrary code execution in the DXE phase, before several chipset locks a... • https://www.insyde.com/security-pledge • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2023-22612
https://notcve.org/view.php?id=CVE-2023-22612
11 Apr 2023 — An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. A malicious host OS can invoke an Insyde SMI handler with malformed arguments, resulting in memory corruption in SMM. • https://research.nccgroup.com/2023/04/11/stepping-insyde-system-management-mode • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2022-34325
https://notcve.org/view.php?id=CVE-2022-34325
14 Nov 2022 — DMA transactions which are targeted at input buffers used for the StorageSecurityCommandDxe software SMI handler could cause SMRAM corruption through a TOCTOU attack. DMA transactions which are targeted at input buffers used for the software SMI handler used by the StorageSecurityCommandDxe driver could cause SMRAM corruption. This issue was discovered by Insyde engineering based on the general description provided by Las transacciones DMA que están dirigidas a los búferes de entrada utilizados para el cont... • https://www.insyde.com/security-pledge • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •
CVSS: 8.2EPSS: 0%CPEs: 2EXPL: 1CVE-2022-36448
https://notcve.org/view.php?id=CVE-2022-36448
28 Sep 2022 — An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. There is an SMM memory corruption vulnerability in the Software SMI handler in the PnpSmm driver. Se ha detectado un problema en InsydeH2O con el kernel versiones 5.0 hasta 5.5. Se presenta una vulnerabilidad de corrupción de memoria SMM en el manejador SMI de software en el controlador PnpSmm • https://binarly.io/advisories/BRLY-2022-023/index.html • CWE-20: Improper Input Validation •
CVSS: 8.2EPSS: 0%CPEs: 6EXPL: 0CVE-2022-35893
https://notcve.org/view.php?id=CVE-2022-35893
23 Sep 2022 — An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An SMM memory corruption vulnerability in the FvbServicesRuntimeDxe driver allows an attacker to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM. Se ha detectado un problema en Insyde InsydeH2O con el kernel versiones 5.0 hasta 5.5. Una vulnerabilidad de corrupción de memoria SMM en el controlador FvbServicesRuntimeDxe permite a un atacante escribir datos fijos o predecibles en... • https://binarly.io/advisories/BRLY-2022-026/index.html • CWE-20: Improper Input Validation •
CVSS: 6.0EPSS: 0%CPEs: 6EXPL: 1CVE-2022-35894
https://notcve.org/view.php?id=CVE-2022-35894
22 Sep 2022 — An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. The SMI handler for the FwBlockServiceSmm driver uses an untrusted pointer as the location to copy data to an attacker-specified buffer, leading to information disclosure. Se ha detectado un problema en InsydeH2O con el kernel versiones 5.0 hasta 5.5. El controlador SMI para el controlador FwBlockServiceSmm usa un puntero que no es confiable como ubicación para copiar datos en un búfer especificado por el atacante, conllevando a una di... • https://binarly.io/advisories/BRLY-2022-018/index.html • CWE-401: Missing Release of Memory after Effective Lifetime •