CVE-2022-35896 - An issue SMM memory leak vulnerability in SMM driver (SMRAM was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5

Back Back to CVE browser

MEDIUM

An issue SMM memory leak vulnerability in SMM driver (SMRAM was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5

Published Sep 21, 2022

6.0

MEDIUM

CVSS 3.1

EPSS 0.33%

Description

An issue SMM memory leak vulnerability in SMM driver (SMRAM was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An attacker can dump SMRAM contents via the software SMI provided by the FvbServicesRuntimeDxe driver to read the contents of SMRAM, leading to information disclosure.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-20

Improper Input Validation

References (4)

https://binarly.io/advisories/BRLY-2022-025/index.html
x_refsource_MISCExploitThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-38769
Advisory
https://www.insyde.com/security-pledge
x_refsource_MISCVendor Advisory
https://www.insyde.com/security-pledge/SA-2022034
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://binarly.io/advisories/BRLY-2022-025/index.html		x_refsource_MISCExploitThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-38769		Advisory
https://www.insyde.com/security-pledge		x_refsource_MISCVendor Advisory
https://www.insyde.com/security-pledge/SA-2022034		x_refsource_MISCVendor Advisory