CVE-2023-22614

CVSS V2 None CVSS V3 None

Description

An issue was discovered in ChipsetSvcSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. There is insufficient input validation in BIOS Guard updates. An attacker can induce memory corruption in SMM by supplying malformed inputs to the BIOS Guard SMI handler.

Overview

CVE ID
CVE-2023-22614

Assigner
cve@mitre.org

Vulnerability Status
Undergoing Analysis

Published Version
2023-04-11T21:15:17

Last Modified Date
2023-04-12T12:44:13

References

Reference URL	Reference Tags
https://research.nccgroup.com/2023/04/11/stepping-insyde-system-management-mode/
https://www.insyde.com/security-pledge
https://www.insyde.com/security-pledge/SA-2023020

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2023-22614
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22614

History

Created	Old Value	New Value	Data Type	Notes
2023-04-17 04:32:17				Added to TrackCVE
2023-04-17 17:00:57	Awaiting Analysis	Undergoing Analysis	Vulnerability Status	updated