Summary
Ein privilegierter lokaler Angreifer kann mehrere Schwachstellen in Insyde UEFI Firmware ausnutzen, um beliebigen Programmcode auszuführen.
Product
InsydeH2O UEFI BIOS ist eine proprietäre, lizenzierte UEFI-BIOS-Firmware, die Intel und AMD basierte Computer unterstützt.
Vulnerabilities 3
-
High 7.5
UsbCoreDxe: improper input validation may lead to arbitrary code execution
UsbCoreDxe has a vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level.
-
High 7.5
Tcg2Smm: improper input validation may lead to arbitrary code execution
Tcg2Smm has a vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level.
-
High 7.5
SetupUtility: A buffer overflow vulnerability leads to arbitrary code execution.
A buffer overflow vulnerability exists in the module SetupUtility. An attacker with local privileged access can exploit this vulnerability by executeing arbitrary code.
Revision history
-
#2
Neue Updates von Dell aufgenommen
-
#1
Initiale Fassung
References
-
Insyde Security Advisory INSYDE-SA-2025005 vom 2025-08-12
https://www.insyde.com/security-pledge/sa-2025005/
-
Lenovo Security Advisory LEN-200921 vom 2025-08-13
https://support.lenovo.com/us/en/product_security/LEN-200921
-
Dell Security Advisory DSA-2024-261 vom 2025-08-14
https://www.dell.com/support/kbdoc/000336679