CVE-2023-39284

2023-11-0200:00:00

mitre

www.cve.org

cve-2023-39284

arbitrary calls

setvariable

smi handler

insydeh2o

kernel 5.0

5.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.2%

JSON

An issue was discovered in IhisiServicesSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. There are arbitrary calls to SetVariable with unsanitized arguments in the SMI handler.

References

www.insyde.com/security-pledge

www.insyde.com/security-pledge/SA-2023056