What is CVE-2022-30773?

CVE-2022-30773 is a vulnerability that allows DMA attacks on the parameter buffer used by the IhisiSmm driver, which can change the contents after parameter values have been checked but before they are used (a TOCTOU attack).

What is the severity of CVE-2022-30773?

The severity of CVE-2022-30773 is medium, with a CVSS score of 6.4.

Which software versions are affected by CVE-2022-30773?

The affected software versions for CVE-2022-30773 are Insyde Kernel versions 5.4.05.44.23 to 5.4 and versions 5.5.05.52.23 to 5.5.

How can I fix CVE-2022-30773?

To fix CVE-2022-30773, it is recommended to follow the security pledge provided by Insyde, the vendor of the affected software. More information can be found at the following link: [Insyde Security Pledge](https://www.insyde.com/security-pledge)

What is a TOCTOU attack?

A TOCTOU (Time of Check to Time of Use) attack refers to a type of vulnerability where the validity of a condition is checked at one point (Time of Check), but that condition can change before it is used (Time of Use), leading to a security weakness.

Vulnerability/
CVE-2022-30773

medium

6.4

CWE

367

14/11/2022

3/8/2024

CVE-2022-30773

First published: Mon Nov 14 2022(Updated: )

DMA attacks on the parameter buffer used by the IhisiSmm driver could change the contents after parameter values have been checked but before they are used (a TOCTOU attack). DMA attacks on the parameter buffer used by the IhisiSmm driver could change the contents after parameter values have been checked but before they are used (a TOCTOU attack). This issue was discovered by Insyde engineering. This issue is fixed in Kernel 5.4: 05.44.23 and Kernel 5.5: 05.52.23. CWE-367

Credit: cve@mitre.org

Affected Software	Affected Version	How to fix
Insyde Kernel	>=5.4<5.4.05.44.23
Insyde Kernel	>=5.5<5.5.05.52.23

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is CVE-2022-30773?
CVE-2022-30773 is a vulnerability that allows DMA attacks on the parameter buffer used by the IhisiSmm driver, which can change the contents after parameter values have been checked but before they are used (a TOCTOU attack).
What is the severity of CVE-2022-30773?
The severity of CVE-2022-30773 is medium, with a CVSS score of 6.4.
Which software versions are affected by CVE-2022-30773?
The affected software versions for CVE-2022-30773 are Insyde Kernel versions 5.4.05.44.23 to 5.4 and versions 5.5.05.52.23 to 5.5.
How can I fix CVE-2022-30773?
To fix CVE-2022-30773, it is recommended to follow the security pledge provided by Insyde, the vendor of the affected software. More information can be found at the following link: [Insyde Security Pledge](https://www.insyde.com/security-pledge)
What is a TOCTOU attack?
A TOCTOU (Time of Check to Time of Use) attack refers to a type of vulnerability where the validity of a condition is checked at one point (Time of Check), but that condition can change before it is used (Time of Use), leading to a security weakness.

collector/nvd-index
agent/type
agent/references
agent/softwarecombine
collector/mitre-cve
source/MITRE
agent/last-modified-date
agent/severity
agent/weakness
agent/author
agent/first-publish-date
agent/event
agent/description
agent/tags
agent/source
vendor/insyde
canonical/insyde kernel
version/insyde kernel/5.4
version/insyde kernel/5.5

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.