Vulnerability Description
Manipulation of the input address in PnpSmm function 0x52 could be used by malware to overwrite SMRAM or OS kernel memory. Function 0x52 of the PnpSmm driver is passed the address and size of data to write into the SMBIOS table, but manipulation of the address could be used by malware to overwrite SMRAM or OS kernel memory. This issue was discovered by Insyde engineering during a security review. This issue is fixed in: Kernel 5.0: 05.09.41 Kernel 5.1: 05.17.43 Kernel 5.2: 05.27.30 Kernel 5.3: 05.36.30 Kernel 5.4: 05.44.30 Kernel 5.5: 05.52.30 https://www.insyde.com/security-pledge/SA-2022065
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Insyde | Kernel | >= 5.0, < 5.0.05.09.41 |
Related Weaknesses (CWE)
References
- https://www.insyde.com/security-pledgeVendor Advisory
- https://www.insyde.com/security-pledge/SA-2022065Vendor Advisory
- https://www.insyde.com/security-pledgeVendor Advisory
- https://www.insyde.com/security-pledge/SA-2022065Vendor Advisory
FAQ
What is CVE-2022-30772?
CVE-2022-30772 is a vulnerability with a CVSS score of 8.2 (HIGH). Manipulation of the input address in PnpSmm function 0x52 could be used by malware to overwrite SMRAM or OS kernel memory. Function 0x52 of the PnpSmm driver is passed the address and size of data to ...
How severe is CVE-2022-30772?
CVE-2022-30772 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-30772?
Check the references section above for vendor advisories and patch information. Affected products include: Insyde Kernel.