Vulnerability · Published Sep 28, 2022 · Assigned by mitre

CVE-2022-36448

High 8.2

In plain English

A high-severity improper input validation in the affected software. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.3%top 73.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. There is an SMM memory corruption vulnerability in the Software SMI handler in the PnpSmm driver.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

Weakness: CWE-20 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

https://www.insyde.com/security-pledge x_refsource_MISC
https://binarly.io/advisories/BRLY-2022-023/index.html x_refsource_MISC
https://www.insyde.com/security-pledge/SA-2022032 x_refsource_MISC