CVE-2022-24031 HIGH

Published: 2022-02-03 | Last Modified: 2026-08-11 | Status: Modified

Description

An issue was discovered in NvmExpressDxe in Insyde InsydeH2O with kernel 5.1 through 5.5. An SMM memory corruption vulnerability allows an attacker to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM.

Additional Descriptions (1)

Se ha detectado un problema en NvmExpressDxe en InsydeH2O con kernel versiones 5.1 hasta 5.5. Una vulnerabilidad de corrupción de memoria SMM permite a un atacante escribir datos fijos o predecibles en la SMRAM. Una explotación de este problema podría conllevar a una escalada de privilegios en SMM

CVSS Metrics

Base Score: 8.2 (HIGH)

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector	LOCAL
Attack Complexity	LOW
Privileges Required	HIGH
User Interaction	NONE
Scope	CHANGED
Confidentiality Impact	HIGH
Integrity Impact	HIGH
Availability Impact	HIGH

Source: [email protected]

Type: Primary

Exploitability Score: 1.5

Impact Score: 6.0

Base Score: 7.2 (HIGH)

AV:L/AC:L/Au:N/C:C/I:C/A:C

Access Vector	LOCAL
Access Complexity	LOW
Authentication	NONE
Confidentiality Impact	COMPLETE
Integrity Impact	COMPLETE
Availability Impact	COMPLETE

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 10.0

Weaknesses

Source	Type	Description
[email protected]	Primary	en CWE-787

Affected Products

Vendor	Product	Version	Update	Type
insyde	insydeh2o	*	<built-in method update of dict object at 0x72f05a795080>	Application
insyde	insydeh2o	*	<built-in method update of dict object at 0x72f05a434800>	Application
insyde	insydeh2o	*	<built-in method update of dict object at 0x72f05a436f00>	Application
insyde	insydeh2o	*	<built-in method update of dict object at 0x72f05a796d00>	Application
insyde	insydeh2o	*	<built-in method update of dict object at 0x72f05a796500>	Application

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:a:insyde:insydeh2o::::::::`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:a:insyde:insydeh2o::::::::`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:a:insyde:insydeh2o::::::::`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:a:insyde:insydeh2o::::::::`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:a:insyde:insydeh2o::::::::`

References

https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf
Source: [email protected]

Third Party Advisory
https://security.netapp.com/advisory/ntap-20220216-0009/
Source: [email protected]

Third Party Advisory
https://www.insyde.com/security-pledge
Source: [email protected]

Vendor Advisory
https://www.insyde.com/security-pledge/SA-2022015
Source: [email protected]

Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf
Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory
https://security.netapp.com/advisory/ntap-20220216-0009/
Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory
https://www.insyde.com/security-pledge
Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory
https://www.insyde.com/security-pledge/SA-2022015
Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory
https://www.kb.cert.org/vuls/id/796611
Source: af854a3a-2127-422b-91ae-364da2661108
https://cert-portal.siemens.com/productcert/html/ssa-306654.html
Source: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e