1. Home
  2. CVE Database
  3. CVE-2022-35896
MEDIUM · 6.0

CVE-2022-35896

An issue SMM memory leak vulnerability in SMM driver (SMRAM was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An attacker can dump SMRAM contents via the software SMI provided by the Fvb...

Vulnerability Description

An issue SMM memory leak vulnerability in SMM driver (SMRAM was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An attacker can dump SMRAM contents via the software SMI provided by the FvbServicesRuntimeDxe driver to read the contents of SMRAM, leading to information disclosure.

CVSS Score

6.0

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
InsydeInsydeh2O>= 5.0, <= 5.5

Related Weaknesses (CWE)

CWE-20

References

FAQ

What is CVE-2022-35896?

CVE-2022-35896 is a vulnerability with a CVSS score of 6.0 (MEDIUM). An issue SMM memory leak vulnerability in SMM driver (SMRAM was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An attacker can dump SMRAM contents via the software SMI provided by the Fvb...

How severe is CVE-2022-35896?

CVE-2022-35896 has been rated MEDIUM with a CVSS base score of 6.0/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-35896?

Check the references section above for vendor advisories and patch information. Affected products include: Insyde Insydeh2O.