Skip to content
OpenAdvisories
Medium WID-SEC-2023-0706 16 CVEs

Insyde UEFI Firmware: Mehrere Schwachstellen

Published Mar 21, 2023 · Updated Mar 21, 2023 · de-DE

Vendor: HP Vendor: Insyde Software Product: Computer Product: UEFI Firmware

Summary

Ein lokaler Angreifer kann mehrere Schwachstellen in der Insyde UEFI Firmware ausnutzen, um beliebigen Code auszuführen, Informationen offenzulegen oder einen Denial of Service zu verursachen.

Product

InsydeH2O UEFI BIOS ist eine proprietäre, lizenzierte UEFI-BIOS-Firmware, die Intel und AMD basierte Computer unterstützt.

Vulnerabilities 16

  • High 7.8
    CVE-2022-34325

    DMA transactions which are targeted at input buffers used for the StorageSecurityCommandDxe software SMI handler could …

  • High 7.0
    CVE-2022-33905

    DMA transactions which are targeted at input buffers used for the AhciBusDxe software SMI handler could cause SMRAM cor…

  • High 7.0
    CVE-2022-33908

    DMA transactions which are targeted at input buffers used for the SdHostDriver software SMI handler could cause SMRAM c…

  • High 7.0
    CVE-2022-33909

    DMA transactions which are targeted at input buffers used for the HddPassword software SMI handler could cause SMRAM co…

  • High 7.0
    CVE-2022-33983

    DMA transactions which are targeted at input buffers used for the NvmExpressLegacy software SMI handler could cause SMR…

  • High 7.0
    CVE-2022-33984

    DMA transactions which are targeted at input buffers used for the SdMmcDevice software SMI handler could cause SMRAM co…

  • High 7.0
    CVE-2022-33985

    DMA transactions which are targeted at input buffers used for the NvmExpressDxe software SMI handler could cause SMRAM …

  • Medium 6.4
    CVE-2022-30773

    DMA attacks on the parameter buffer used by the IhisiSmm driver could change the contents after parameter values have b…

  • Medium 6.4
    CVE-2022-30774

    DMA attacks on the parameter buffer used by the PnpSmm driver could change the contents after parameter values have bee…

  • Medium 6.4
    CVE-2022-31243

    Update description and links DMA transactions which are targeted at input buffers used for the software SMI handler use…

  • Medium 6.4
    CVE-2022-32266

    DMA attacks on the parameter buffer used by a software SMI handler used by the driver PcdSmmDxe could lead to a TOCTOU …

  • Medium 6.4
    CVE-2022-32267

    DMA transactions which are targeted at input buffers used for the SmmResourceCheckDxe software SMI handler cause SMRAM …

  • Medium 6.4
    CVE-2022-33906

    DMA transactions which are targeted at input buffers used for the FwBlockServiceSmm software SMI handler could cause SM…

  • Medium 6.4
    CVE-2022-33907

    DMA transactions which are targeted at input buffers used for the software SMI handler used by the IdeBusDxe driver cou…

  • Medium 6.4
    CVE-2022-33982

    DMA attacks on the parameter buffer used by the Int15ServiceSmm software SMI handler could lead to a TOCTOU attack on t…

  • Medium 6.4
    CVE-2022-33986

    DMA attacks on the parameter buffer used by the VariableRuntimeDxe software SMI handler could lead to a TOCTOU attack. …

Revision history

  1. #1

    Initiale Fassung

References