Insyde InsydeH2O Buffer Overflow Vulnerability (CNVD-2022-10287)

Insyde InsydeH2O is a C source from Insyde Software (Taiwan, China) that implements the new technology “EFI/UEFI” specification, designed to replace the legacy BIOS (Basic Input/Output System). -A buffer overflow vulnerability in the 2-Operating System (H2O) UEFI firmware could be exploited to write fixed or predictable data to SMRAM, resulting in an escalation of privileges in SMM.