High severity · published Nov 22, 2022
CVE-2022-35407
An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. A stack buffer overflow leads to arbitrary code execution in the SetupUtility driver on Intel platforms. An attacker can change the values of certain UEFI variables. If the size of the second variable exceeds the size of the first, then the buffer will be overwritten. This issue affects the SetupUtility driver of InsydeH2O.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KE
Kernel · Insyde
5.0 through 5.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-35407
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-35407
Vendor Advisory
https://www.insyde.com/security-pledge
Vendor Advisory
https://www.insyde.com/security-pledge/SA-2022040
More from Kernel
9.8
CVE-2021-38578
Existing CommBuffer checks in SmmEntryPoint will not catch underflow when computing BufferSize
8.2
CVE-2022-36337
An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5
8.2
CVE-2022-29279
Use of a untrusted pointer allows tampering with SMRAM and OS memory in SdHostDriver and SdMmcDevice Use of a untrusted pointer allows tampering with SMRAM and OS memory in…
8.2
CVE-2022-29278
Incorrect pointer checks within the NvmExpressDxe driver can allow tampering with SMRAM and OS memory Incorrect pointer checks within the NvmExpressDxe driver can allow tampering…
8.2
CVE-2022-29276
SMI functions in AhciBusDxe use untrusted inputs leading to corruption of SMRAM