CVE-2022-32475

EPSS 0.05%
Published 15.02.2023 14:15:11
Last modified 05.05.2025 17:18:14
Source cve@mitre.org
Teams watchlist Login
Open Login

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the VariableRuntimeDxe shared buffer used by SMM and non-SMM code could cause TOCTOU race-condition issues that could lead to corruption of SMRAM and escalation of privileges. This issue was fixed in the kernel, which also protected chipset and OEM chipset code.

Affected products Warnungen 0 Metrics 3 CWE 1 References 5

Data is provided by the National Vulnerability Database (NVD)

Insyde ≫ Insydeh2o Version >= 5.0 < 5.2.05.27.27

Insyde ≫ Insydeh2o Version >= 5.3 < 5.3.05.36.27

Insyde ≫ Insydeh2o Version >= 5.4 < 5.4.05.44.27

Insyde ≫ Insydeh2o Version >= 5.5 < 5.5.05.52.27

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.05%	0.115

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	7	1	5.9	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
134c704f-9b21-4f2e-91b3-4a467353bcc0	7	1	5.9	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state.

https://www.insyde.com/security-pledge

Vendor Advisory

https://www.insyde.com/security-pledge/SA-2023007

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2022-32475

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2022-32475

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2022-32475

EUVD