Back to feed
EUVD-2022-39054 · Published Sep 23, 2022
An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An SMM callout vulnerability in the SMM driver FwBlockServiceSmm, creating SMM, leads to arbitrary code execution. An attacker can replace the pointer to the UEFI boot service GetVariable with a pointer to malware, and then generate a software SMI.
Technologies
Insyde Insydeh2O
CVSS scores
- v3.18.2
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
MITRE ATT&CK
InferredWhere this vulnerability fits in an attack
Privilege Escalation
References
Potentially impacted assets
See if this affects your attack surface
