CVE-2022-30426: Buffer Overflow
There is a stack buffer overflow vulnerability, which could lead to arbitrary code execution in UEFI DXE driver on some Acer products. An attack could exploit this vulnerability to escalate privilege from ring 3 to ring 0, and hijack control flow during UEFI DXE execution. This affects Altos T110 F3 firmware version <= P13 (latest) and AP130 F2 firmware version <= P04 (latest) and Aspire 1600X firmware version <= P11.A3L (latest) and Aspire 1602M firmware version <= P11.A3L (latest) and Aspire 7600U firmware version <= P11.A4 (latest) and Aspire MC605 firmware version <= P11.A4L (latest) and Aspire TC-105 firmware version <= P12.B0L (latest) and Aspire TC-120 firmware version <= P11-A4 (latest) and Aspire U5-620 firmware version <= P11.A1 (latest) and Aspire X1935 firmware version <= P11.A3L (latest) and Aspire X3475 firmware version <= P11.A3L (latest) and Aspire X3995 firmware version <= P11.A3L (latest) and Aspire XC100 firmware version <= P11.B3 (latest) and Aspire XC600 firmware version <= P11.A4 (latest) and Aspire Z3-615 firmware version <= P11.A2L (latest) and Veriton E430G firmware version <= P21.A1 (latest) and Veriton B63049 firmware version <= AAP02SR (latest) and Veriton E430 firmware version <= P11.A4 (latest) and Veriton M2110G firmware version <= P21.A3 (latest) and Veriton M2120G fir.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Acer firmware (UEFI DXE driver)to a version that resolves this vulnerability.Fixed in P13 - Upgrade
Upgrade
Acer firmware (UEFI DXE driver)to a version that resolves this vulnerability.Fixed in P04 - Upgrade
Upgrade
Acer firmware (UEFI DXE driver)to a version that resolves this vulnerability.Fixed in P11.A3L - Upgrade
Upgrade
Acer firmware (UEFI DXE driver)to a version that resolves this vulnerability.Fixed in P11.A4 - Upgrade
Upgrade
Acer firmware (UEFI DXE driver)to a version that resolves this vulnerability.Fixed in P11.A4L - Upgrade
Upgrade
Acer firmware (UEFI DXE driver)to a version that resolves this vulnerability.Fixed in P12.B0L - Upgrade
Upgrade
Acer firmware (UEFI DXE driver)to a version that resolves this vulnerability.Fixed in P11-A4 - Upgrade
Upgrade
Acer firmware (UEFI DXE driver)to a version that resolves this vulnerability.Fixed in P11.A1 - Upgrade
Upgrade
Acer firmware (UEFI DXE driver)to a version that resolves this vulnerability.Fixed in P11.B3 - Upgrade
Upgrade
Acer firmware (UEFI DXE driver)to a version that resolves this vulnerability.Fixed in P11.A2L - Upgrade
Upgrade
Acer firmware (UEFI DXE driver)to a version that resolves this vulnerability.Fixed in P21.A1 - Upgrade
Upgrade
Acer firmware (UEFI DXE driver)to a version that resolves this vulnerability.Fixed in AAP02SR - Upgrade
Upgrade
Acer firmware (UEFI DXE driver)to a version that resolves this vulnerability.Fixed in P21.A3
Event History
Frequently Asked Questions
What is the severity of CVE-2022-30426?
CVE-2022-30426 is classified as a critical vulnerability due to its potential to allow arbitrary code execution via a stack buffer overflow.
How do I fix CVE-2022-30426?
To mitigate CVE-2022-30426, you should update the firmware of affected Acer products to the latest version provided by Acer.
Which Acer products are affected by CVE-2022-30426?
CVE-2022-30426 affects various Acer firmware versions, including those for the Acer Altos T110 F3, Acer Ap130 F2, and Acer Aspire series.
What type of vulnerability is CVE-2022-30426?
CVE-2022-30426 is a stack buffer overflow vulnerability in the UEFI DXE driver allowing privilege escalation.
Can CVE-2022-30426 be exploited remotely?
Yes, CVE-2022-30426 may be exploited remotely, enabling attackers to gain control over the system during UEFI DXE execution.