RCE in Insyde Insydeh2o
CVE-2023-34195
An issue was discovered in SystemFirmwareManagementRuntimeDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. The implementation of the GetImage method retrieves the value of a runtime variable named GetImageProgress, and later uses this value as a function pointer. This variable is wiped out by the same module near the end of the function. By setting this UEFI variable from the OS to point into custom code, an attacker could achieve arbitrary code execution in the DXE phase, before several chipset locks are set.
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.002 (12.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Insyde Insydeh2o
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (Vendor Advisory)
- cve@mitre.org (Vendor Advisory)
Frequently asked questions
- What is CVE-2023-34195?
- CVE-2023-34195 is a high-severity vulnerability in Insyde Insydeh2o, classified under Code Injection. CVSS score: 7.8/10. Published 2023-09-18.
- How severe is CVE-2023-34195?
- High severity. CVSS v3 base score is 7.8 out of 10.