Medium WID-SEC-2025-1038 4 CVEs

Insyde UEFI Firmware: Mehrere Schwachstellen ermöglichen Denial of Service

Published May 13, 2025 · Updated May 15, 2025 · Revision 2 · de-DE

Vendor: Insyde Software Vendor: Lenovo Product: Computer Product: UEFI Firmware

Summary

Ein lokaler Angreifer kann mehrere Schwachstellen in Insyde UEFI Firmware ausnutzen, um einen Denial of Service Angriff durchzuführen.

Product

InsydeH2O UEFI BIOS ist eine proprietäre, lizenzierte UEFI-BIOS-Firmware, die Intel und AMD basierte Computer unterstützt.

Vulnerabilities 4

High 7.9

CVE-2024-52880

An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, ker…

May 15, 2025
High 7.5

CVE-2024-52877

An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, ker…

May 15, 2025
High 7.5

CVE-2024-52878

An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, ker…

May 15, 2025
High 7.5

CVE-2024-52879

An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, ker…

May 15, 2025

Revision history

2025-05-15 #2
Referenz(en) aufgenommen: EUVD-2024-54545, EUVD-2024-54546, EUVD-2024-54544, EUVD-2024-54547
2025-05-13 #1
Initiale Fassung

References

Insyde Security Advisory INSYDE-SA-2024016 vom 2025-05-13
https://www.insyde.com/security-pledge/sa-2024016/
Lenovo Security Advisory LEN-195071 vom 2025-05-14
https://support.lenovo.com/us/en/product_security/LEN-195071