CVE-2022-30773: Medium severity insyde kernel vulnerability
DMA attacks on the parameter buffer used by the IhisiSmm driver could change the contents after parameter values have been checked but before they are used (a TOCTOU attack). DMA attacks on the parameter buffer used by the IhisiSmm driver could change the contents after parameter values have been checked but before they are used (a TOCTOU attack). This issue was discovered by Insyde engineering. This issue is fixed in Kernel 5.4: 05.44.23 and Kernel 5.5: 05.52.23. CWE-367
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-30773?
CVE-2022-30773 is a vulnerability that allows DMA attacks on the parameter buffer used by the IhisiSmm driver, which can change the contents after parameter values have been checked but before they are used (a TOCTOU attack).
What is the severity of CVE-2022-30773?
The severity of CVE-2022-30773 is medium, with a CVSS score of 6.4.
Which software versions are affected by CVE-2022-30773?
The affected software versions for CVE-2022-30773 are Insyde Kernel versions 5.4.05.44.23 to 5.4 and versions 5.5.05.52.23 to 5.5.
How can I fix CVE-2022-30773?
To fix CVE-2022-30773, it is recommended to follow the security pledge provided by Insyde, the vendor of the affected software. More information can be found at the following link: [Insyde Security Pledge](https://www.insyde.com/security-pledge)
What is a TOCTOU attack?
A TOCTOU (Time of Check to Time of Use) attack refers to a type of vulnerability where the validity of a condition is checked at one point (Time of Check), but that condition can change before it is used (Time of Use), leading to a security weakness.