CVE-2023-39283

2023-11-0222:15:09

CWE-787

mitre

web.nvd.nist.gov

cve-2023-39283

smm memory corruption

insyde insydeh2o

privilege escalation

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.7

Confidence

High

EPSS

Percentile

9.0%

JSON

An SMM memory corruption vulnerability in the SMM driver (SMRAM write) in CsmInt10HookSmm in Insyde InsydeH2O with kernel 5.0 through 5.5 allows attackers to send arbitrary data to SMM which could lead to privilege escalation.

Affected configurations

Nvd

Node

insydeinsydeh2oRange5.0–5.5

insydeinsydeh2oMatch5.5.05.53.22

insydeinsydeh2oMatch5.6

insydeinsydeh2oMatch5.6.05.60.22

VendorProductVersionCPE
insydeinsydeh2o*cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*
insydeinsydeh2o5.5.05.53.22cpe:2.3:a:insyde:insydeh2o:5.5.05.53.22:*:*:*:*:*:*:*
insydeinsydeh2o5.6cpe:2.3:a:insyde:insydeh2o:5.6:*:*:*:*:*:*:*
insydeinsydeh2o5.6.05.60.22cpe:2.3:a:insyde:insydeh2o:5.6.05.60.22:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
insyde	insydeh2o	*	cpe:2.3:a:insyde:insydeh2o::::::::
insyde	insydeh2o	5.5.05.53.22	cpe:2.3:a:insyde:insydeh2o:5.5.05.53.22:::::::*
insyde	insydeh2o	5.6	cpe:2.3:a:insyde:insydeh2o:5.6:::::::*
insyde	insydeh2o	5.6.05.60.22	cpe:2.3:a:insyde:insydeh2o:5.6.05.60.22:::::::*