CVE-2022-36448

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. There is an SMM memory corruption vulnerability in the Software SMI handler in the PnpSmm driver.

CVSS v3.0 8.2 HIGH

8.2^/10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 1.5 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://binarly.io/advisories/BRLY-2022-023/index.html	Exploit Third Party Advisory
https://www.insyde.com/security-pledge	Vendor Advisory
https://www.insyde.com/security-pledge/SA-2022032	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*

Information

Published : 2022-09-28 09:15

Updated : 2022-09-30 07:05

NVD link : CVE-2022-36448

Mitre link : CVE-2022-36448

JSON object : View

CWE

NVD-CWE-noinfo

Products Affected

insyde

insydeh2o

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://binarly.io/advisories/BRLY-2022-023/index.html", "name": "https://binarly.io/advisories/BRLY-2022-023/index.html", "tags": ["Exploit", "Third Party Advisory"], "refsource": "MISC"}, {"url": "https://www.insyde.com/security-pledge", "name": "https://www.insyde.com/security-pledge", "tags": ["Vendor Advisory"], "refsource": "MISC"}, {"url": "https://www.insyde.com/security-pledge/SA-2022032", "name": "https://www.insyde.com/security-pledge/SA-2022032", "tags": ["Vendor Advisory"], "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. There is an SMM memory corruption vulnerability in the Software SMI handler in the PnpSmm driver."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2022-36448", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV3": {"cvssV3": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.5}}, "publishedDate": "2022-09-28T16:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "05.44.30", "versionStartIncluding": "5.4"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "05.52.30", "versionStartIncluding": "5.5"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2022-09-30T14:05Z"}

8.2 /10