CVE-2022-35893

moderate-risk

Published 2022-09-23

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An SMM memory corruption vulnerability in the FvbServicesRuntimeDxe driver allows an attacker to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM.

Do I need to act?

0.16% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.2/10 High

LOCAL / LOW complexity

Affected Products (1)

Insydeh2O

Affected Vendors

Insyde

References (6)

Third Party Advisory https://binarly.io/advisories/BRLY-2022-026/index.html

Vendor Advisory https://www.insyde.com/security-pledge

Vendor Advisory https://www.insyde.com/security-pledge/SA-2022035

Third Party Advisory https://binarly.io/advisories/BRLY-2022-026/index.html

Vendor Advisory https://www.insyde.com/security-pledge

Vendor Advisory https://www.insyde.com/security-pledge/SA-2022035

/ 100

moderate-risk

Severity 25/34 · High

Exploitability 1/34 · Minimal

Exposure 5/34 · Minimal