CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 1CVE-2023-40238
https://notcve.org/view.php?id=CVE-2023-40238
A LogoFAIL issue was discovered in BmpDecoderDxe in Insyde InsydeH2O with kernel 5.2 before 05.28.47, 5.3 before 05.37.47, 5.4 before 05.45.47, 5.5 before 05.53.47, and 5.6 before 05.60.47 for certain Lenovo devices. Image parsing of crafted BMP logo files can copy data to a specific address during the DXE phase of UEFI execution. This occurs because of an integer signedness error involving PixelHeight and PixelWidth during RLE4/RLE8 compression. Se descubrió un problema de LogoFAIL en BmpDecoderDxe en Insyde InsydeH2O con kernel 5.2 anterior a 05.28.47, 5.3 anterior a 05.37.47, 5.4 anterior a 05.45.47, 5.5 anterior a 05.53.47 y 5.6 anterior a 05.60.47 para ciertos dispositivos Lenovo. El análisis de imágenes de archivos de logotipos BMP manipulados puede copiar datos a una dirección específica durante la fase DXE de la ejecución UEFI. • https://binarly.io/posts/finding_logofail_the_dangers_of_image_parsing_during_system_boot/index.html https://security.netapp.com/advisory/ntap-20240105-0002 https://www.insyde.com/security-pledge https://www.insyde.com/security-pledge/SA-2023053 https://www.kb.cert.org/vuls/id/811862 • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2023-39283
https://notcve.org/view.php?id=CVE-2023-39283
An SMM memory corruption vulnerability in the SMM driver (SMRAM write) in CsmInt10HookSmm in Insyde InsydeH2O with kernel 5.0 through 5.5 allows attackers to send arbitrary data to SMM which could lead to privilege escalation. Una vulnerabilidad de corrupción de memoria SMM en el controlador SMM (SMRAM write) en CsmInt10HookSmm en Insyde InsydeH2O con kernel 5.0 a 5.5 permite a atacantes enviar datos arbitrarios a SMM, lo que podría conducir a una escalada de privilegios. • https://www.insyde.com/security-pledge https://www.insyde.com/security-pledge/SA-2023055 • CWE-787: Out-of-bounds Write •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2023-39284
https://notcve.org/view.php?id=CVE-2023-39284
An issue was discovered in IhisiServicesSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. There are arbitrary calls to SetVariable with unsanitized arguments in the SMI handler. Se descubrió un problema en IhisiServicesSmm en Insyde InsydeH2O con kernel 5.0 a 5.5. Hay llamadas arbitrarias a SetVariable con argumentos no sanitizados en el controlador SMI. • https://www.insyde.com/security-pledge https://www.insyde.com/security-pledge/SA-2023056 •
CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2023-22612
https://notcve.org/view.php?id=CVE-2023-22612
An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. A malicious host OS can invoke an Insyde SMI handler with malformed arguments, resulting in memory corruption in SMM. • https://research.nccgroup.com/2023/04/11/stepping-insyde-system-management-mode https://www.insyde.com/security-pledge https://www.insyde.com/security-pledge/SA-2023019 • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2022-34325
https://notcve.org/view.php?id=CVE-2022-34325
DMA transactions which are targeted at input buffers used for the StorageSecurityCommandDxe software SMI handler could cause SMRAM corruption through a TOCTOU attack. DMA transactions which are targeted at input buffers used for the software SMI handler used by the StorageSecurityCommandDxe driver could cause SMRAM corruption. This issue was discovered by Insyde engineering based on the general description provided by Las transacciones DMA que están dirigidas a los búferes de entrada utilizados para el controlador SMI del software StorageSecurityCommandDxe podrían causar corrupción de SMRAM a través de un ataque TOCTOU. Las transacciones DMA que están dirigidas a los búferes de entrada utilizados para el controlador SMI de software utilizado por el controlador StorageSecurityCommandDxe podrían provocar daños en SMRAM. Este problema fue descubierto por la ingeniería de Insyde basándose en la descripción general proporcionada por • https://www.insyde.com/security-pledge https://www.insyde.com/security-pledge/SA-2022057 • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •