CVE Vulnerability

CVE-2022-30773

DMA attacks on the parameter buffer used by the IhisiSmm driver could change the contents after parameter values have been checked but before they are used (a TOCTOU attack). DMA attacks on the parameter buffer used by the IhisiSmm driver could change the contents after parameter values have been checked but before they are used (a TOCTOU attack). This issue was discovered by Insyde engineering. This issue is fixed in Kernel 5.4: 05.44.23 and Kernel 5.5: 05.52.23. CWE-367

6.4 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.5 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.insyde.com/security-pledge Vendor Advisory
https://www.insyde.com/security-pledge/SA-2022042 Vendor Advisory
Configurations

Configuration 1

cpe:2.3:a:insyde:kernel:*:*:*:*:*:*:*:*
cpe:2.3:a:insyde:kernel:*:*:*:*:*:*:*:*
Information

Published : 2022-11-14 10:15

Updated : 2022-11-18 04:01

NVD link : CVE-2022-30773

Mitre link : CVE-2022-30773

Products Affected
No products.
CWE
CWE-367