CVE-2022-26873: The stack buffer overflow vulnerability in PlatformInitAdvancedPreMem leads to arbitrary code execution during PEI phase.
First published: Tue Sep 20 2022(Updated: )
A potential attacker can execute an arbitrary code at the time of the PEI phase and influence the subsequent boot stages. This can lead to the mitigations bypassing, physical memory contents disclosure, discovery of any secrets from any Virtual Machines (VMs) and bypassing memory isolation and confidential computing boundaries. Additionally, an attacker can build a payload which can be injected into the SMRAM memory. This issue affects: Module name: PlatformInitAdvancedPreMem SHA256: 644044fdb8daea30a7820e0f5f88dbf5cd460af72fbf70418e9d2e47efed8d9b Module GUID: EEEE611D-F78F-4FB9-B868-55907F169280 This issue affects: AMI Aptio 5.x.
Credit: cret@cert.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Intel Nuc M15 Laptop Kit Lapbc510 Firmware | ||
| Intel Nuc M15 Laptop Kit Lapbc510 | ||
| Intel Nuc M15 Laptop Kit Lapbc710 Firmware | ||
| Intel Nuc M15 Laptop Kit Lapbc710 | ||
| Ami Aptio V | =5.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-26873?
CVE-2022-26873 is a vulnerability that allows a potential attacker to execute arbitrary code during the PEI phase and influence subsequent boot stages.
What is the severity of CVE-2022-26873?
The severity of CVE-2022-26873 is high, with a severity value of 8.2.
Which software is affected by CVE-2022-26873?
The Intel Nuc M15 Laptop Kit Lapbc510 Firmware and Intel Nuc M15 Laptop Kit Lapbc710 Firmware are affected by CVE-2022-26873.
How can CVE-2022-26873 be exploited?
CVE-2022-26873 can be exploited by executing arbitrary code during the PEI phase of the boot process.
Where can I find more information about CVE-2022-26873?
You can find more information about CVE-2022-26873 at the following references: [link1](https://www.ami.com/security-center/), [link2](https://www.binarly.io/advisories/BRLY-2022-027), [link3](https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00712.html).
- collector/nvd-index
- agent/weakness
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/title
- agent/author
- agent/severity
- agent/references
- agent/tags
- agent/description
- agent/event
- agent/first-publish-date
- vendor/intel
- canonical/intel nuc m15 laptop kit lapbc510 firmware
- canonical/intel nuc m15 laptop kit lapbc510
- canonical/intel nuc m15 laptop kit lapbc710 firmware
- canonical/intel nuc m15 laptop kit lapbc710
- vendor/ami
- canonical/ami aptio v
- version/ami aptio v/5.0