Vulnerability · Published Sep 22, 2022 · Assigned by mitre

CVE-2022-35894

Medium 6.0

In plain English

A medium-severity memory leak in the affected software. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)6.0Medium

Exploit odds (30 days)0.3%top 73.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. The SMI handler for the FwBlockServiceSmm driver uses an untrusted pointer as the location to copy data to an attacker-specified buffer, leading to information disclosure.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

Weakness: CWE-401 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

References

https://www.insyde.com/security-pledge x_refsource_MISC
https://binarly.io/advisories/BRLY-2022-018/index.html x_refsource_MISC
https://www.insyde.com/security-pledge/SA-2022030 x_refsource_MISC