Vulnerability in Insyde Kernel

CVE-2022-32267

DMA transactions which are targeted at input buffers used for the SmmResourceCheckDxe software SMI handler cause SMRAM corruption (a TOCTOU attack) DMA transactions which are targeted at input buffers used for the software SMI handler used by the SmmResourceCheckDxe driver could cause SMRAM corruption through a TOCTOU attack... This issue was discovered by Insyde engineering. Fixed in kernel Kernel 5.2: 05.27.23. Kernel 5.3: 05.36.23. Kernel 5.4: 05.44.23. Kernel 5.5: 05.52.23 https://www.insyde.com/security-pledge/SA-2022046

Vulnerability class: TOCTOU (Time-of-Check to Time-of-Use)

EPSS: 0.001 (3.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.4 (Medium). Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H.

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2022-32267?
CVE-2022-32267 is a medium-severity vulnerability in Insyde Kernel, classified under Time-of-check Time-of-use (TOCTOU) Race Condition. CVSS score: 6.4/10. Published 2022-11-15.
How severe is CVE-2022-32267?
Medium severity. CVSS v3 base score is 6.4 out of 10.