Insyde InsydeH2O Buffer Overflow Vulnerability (CNVD-2022-10285)

Insyde InsydeH2O is a C source from Insyde Software (Taiwan, China) that implements the new technology “EFI/UEFI” specification, designed to replace the legacy BIOS (Basic Input/Output System). Operating System (H2O) UEFI firmware suffers from a buffer overflow vulnerability that stems from the SWSMI handler not adequately checking or validating the allocated buffer pointer (CommBuffer), which could be exploited to corrupt data in SMRAM memory, leading to arbitrary code execution.