Vulnerability · Published Sep 21, 2022 · Assigned by mitre

CVE-2022-35896

Medium 6.0

In plain English

A medium-severity improper input validation in the affected software. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)6.0Medium

Exploit odds (30 days)0.3%top 74.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

An issue SMM memory leak vulnerability in SMM driver (SMRAM was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An attacker can dump SMRAM contents via the software SMI provided by the FvbServicesRuntimeDxe driver to read the contents of SMRAM, leading to information disclosure.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

Weakness: CWE-20 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

References

https://www.insyde.com/security-pledge x_refsource_MISC
https://www.insyde.com/security-pledge/SA-2022034 x_refsource_MISC
https://binarly.io/advisories/BRLY-2022-025/index.html x_refsource_MISC