CVE-2022-24030: High severity Insyde InsydeH2O vulnerability
Published Feb 3, 2022
·Updated
An issue was discovered in AhciBusDxe in Insyde InsydeH2O with kernel 5.1 through 5.5. An SMM memory corruption vulnerability allows an attacker to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM.
Affected Software
6 affected components
Insyde InsydeH2O>=5.0<5.08.41
Insyde InsydeH2O>=5.1<5.16.41
Insyde InsydeH2O>=5.2<5.26.41
Insyde InsydeH2O>=5.3<5.35.41
Insyde InsydeH2O>=5.4<5.43.41
Insyde InsydeH2O>=5.5<5.51.41
Event History
Feb 3, 2022
CVE Published
via MITRE·01:16 AM
Data Sourced
via MITRE·01:16 AM
Description
Data Sourced
via NVD·02:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is CVE-2022-24030?
CVE-2022-24030 is a vulnerability discovered in AhciBusDxe in Insyde InsydeH2O firmware with kernel versions 5.1 through 5.5.
2
What is the severity of CVE-2022-24030?
CVE-2022-24030 has a severity rating of 7.5 (high).
3
What is the affected software of CVE-2022-24030?
Insyde InsydeH2O firmware versions 5.0 through 5.5 are affected by CVE-2022-24030.
4
What is the impact of CVE-2022-24030?
Exploiting CVE-2022-24030 could lead to escalating privileges to System Management Mode (SMM).
5
How can I fix CVE-2022-24030?
To fix CVE-2022-24030, it is recommended to update to a patched version of the Insyde InsydeH2O firmware.