High severity · published May 15, 2025
CVE-2024-52878
An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel 5.5 before version…
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel 5.5 before version 05.54.50, kernel 5.6 before version 05.61.50, and kernel 5.7 before version 05.70.50. In VariableRuntimeDxe driver, VariableServicesSetVariable () can be called by gRT_>SetVariable () or the SmmSetSensitiveVariable () or SmmInternalSetVariable () from SMM. In VariableServicesSetVariable (), it uses StrSize () to get variable name size, uses StrLen () to get variable name length and uses StrCmp () to compare strings. These actions may cause a buffer over-read.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IN
Insydeh2o · Insyde
5.2 before 5.2.05.29.50; 5.3 before 5.3.05.38.50; 5.4 before 5.4.05.46.50; 5.5 before 5.5.05.54.50; 5.6 before 5.6.05.61.50; 5.7 before 5.7.05.70.50 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-52878
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-52878
Vendor Advisory
https://www.insyde.com/security-pledge
Vendor Advisory
https://www.insyde.com/security-pledge/sa-2024016/
More from Insydeh2o
9.8
CVE-2023-39281
A stack buffer overflow vulnerability discovered in AsfSecureBootDxe in Insyde InsydeH2O with kernel 5.0 through 5.5 allows attackers to run arbitrary code execution during the…
9.8
CVE-2021-41842
An issue was discovered in AtaLegacySmm in the kernel 5.0 before 05.08.46, 5.1 before 05.16.46, 5.2 before 05.26.46, 5.3 before 05.35.46, 5.4 before 05.43.46, and 5.5 before…
8.8
CVE-2023-22613
An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5
8.8
CVE-2023-22614
An issue was discovered in ChipsetSvcSmm in Insyde InsydeH2O with kernel 5.0 through 5.5
8.8
CVE-2023-22612
An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5