CVE-2022-24031: High severity Insyde InsydeH2O vulnerability
An issue was discovered in NvmExpressDxe in Insyde InsydeH2O with kernel 5.1 through 5.5. An SMM memory corruption vulnerability allows an attacker to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-24031?
CVE-2022-24031 is an SMM memory corruption vulnerability in NvmExpressDxe in Insyde InsydeH2O with kernel 5.1 through 5.5, which allows an attacker to write fixed or predictable data to SMRAM and potentially escalate privileges to SMM.
What software is affected by CVE-2022-24031?
Insyde InsydeH2O with kernel versions 5.1 through 5.5 is affected by CVE-2022-24031.
How severe is CVE-2022-24031?
CVE-2022-24031 has a severity score of 8.2 (high).
How can CVE-2022-24031 be exploited?
CVE-2022-24031 can be exploited by writing fixed or predictable data to SMRAM, potentially leading to privilege escalation to SMM.
Where can I find more information about CVE-2022-24031?
You can find more information about CVE-2022-24031 at the following references: [Reference 1](https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf), [Reference 2](https://security.netapp.com/advisory/ntap-20220216-0009/), [Reference 3](https://www.insyde.com/security-pledge).