Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-32475

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the VariableRuntimeDxe shared buffer used by SMM and non-SMM code could cause TOCTOU race-condition issues that could lead to corruption of SMRAM and escalation of privileges. This issue was fixed in the kernel, which also protected chipset and OEM chipset code.

Published

2023-02-15T14:15:11.950

Last Modified

2025-05-05T17:18:14.633

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.0 (HIGH)

Weaknesses
  • Type: Primary
    CWE-367
  • Type: Secondary
    CWE-367
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application insyde insydeh2o < 5.2.05.27.27 Yes
Application insyde insydeh2o < 5.3.05.36.27 Yes
Application insyde insydeh2o < 5.4.05.44.27 Yes
Application insyde insydeh2o < 5.5.05.52.27 Yes
References