What is CVE-2022-29279?

CVE-2022-29279 is a high-severity vulnerability in Insyde Kernel, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 8.2/10. Published 2022-11-15.

How severe is CVE-2022-29279?

High severity. CVSS v3 base score is 8.2 out of 10.

Buffer overflow in Insyde Kernel

CVE-2022-29279

Use of a untrusted pointer allows tampering with SMRAM and OS memory in SdHostDriver and SdMmcDevice Use of a untrusted pointer allows tampering with SMRAM and OS memory in SdHostDriver and SdMmcDevice. This issue was discovered by Insyde during security review. It was fixed in: Kernel 5.0: version 05.09.17 Kernel 5.1: version 05.17.17 Kernel 5.2: version 05.27.17 Kernel 5.3: version 05.36.17 Kernel 5.4: version 05.44.17 Kernel 5.5: version 05.52.17 https://www.insyde.com/security-pledge/SA-2022062

Vulnerability class: Buffer Overflow

EPSS: 0.002 (9.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.

Affected products

Insyde Kernel
N/a — versions n/a

Weakness classification (CWE)

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

References

cve@mitre.org (Vendor Advisory)
cve@mitre.org (Vendor Advisory)

Frequently asked questions

What is CVE-2022-29279?: CVE-2022-29279 is a high-severity vulnerability in Insyde Kernel, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 8.2/10. Published 2022-11-15.
How severe is CVE-2022-29279?: High severity. CVSS v3 base score is 8.2 out of 10.