CVE-2022-36338

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5

High · published September 23, 2022

CVSS v3.1
8.2
EPSS
0%
Percentile
39.2
In the wild
Unconfirmed
What it is

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An SMM callout vulnerability in the SMM driver FwBlockServiceSmm, creating SMM, leads to arbitrary code execution. An attacker can replace the pointer to the UEFI boot service GetVariable with a pointer to malware, and then generate a software SMI.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00463 · 39.2th percentile
Published
2022-09-23T17:17Z
EPSS history
Timeline
  • 23 SEP 17:17Z
    An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5
    cvelistv5