Vulnerability in Insyde Insydeh2o

CVE-2022-32471

An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. The IhisiDxe driver uses the command buffer to pass input and output data. By modifying the command buffer contents with DMA after the input parameters have been checked but before they are used, the IHISI SMM code may be convinced to modify SMRAM or OS, leading to possible data corruption or escalation of privileges.

Vulnerability class: TOCTOU (Time-of-Check to Time-of-Use)

EPSS: 0.001 (3.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.0 (High). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2022-32471?
CVE-2022-32471 is a high-severity vulnerability in Insyde Insydeh2o, classified under Time-of-check Time-of-use (TOCTOU) Race Condition. CVSS score: 7.0/10. Published 2023-02-15.
How severe is CVE-2022-32471?
High severity. CVSS v3 base score is 7.0 out of 10.