CVE-2022-30774
First published: Mon Nov 14 2022(Updated: )
DMA attacks on the parameter buffer used by the PnpSmm driver could change the contents after parameter values have been checked but before they are used (a TOCTOU attack) DMA attacks on the parameter buffer used by the PnpSmm driver could change the contents after parameter values have been checked but before they are used (a TOCTOU attack) . This issue was discovered by Insyde engineering during a security review. This iss was fixed in Kernel 5.2: 05.27.29, Kernel 5.3: 05.36.25, Kernel 5.4: 05.44.25, Kernel 5.5: 05.52.25. CWE-367 https://www.insyde.com/security-pledge/SA-2022043
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Insyde Kernel | >=5.2<5.2.05.27.29 | |
| Insyde Kernel | >=5.3<5.3.05.36.25 | |
| Insyde Kernel | >=5.4<5.4.05.44.25 | |
| Insyde Kernel | >=5.5<5.5.05.52.25 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-30774?
CVE-2022-30774 is a vulnerability that allows DMA attacks on the parameter buffer used by the PnpSmm driver, which can change the contents after parameter values have been checked but before they are used.
What is the severity of CVE-2022-30774?
The severity of CVE-2022-30774 is medium, with a CVSS score of 6.4.
Which software is affected by CVE-2022-30774?
The affected software is Insyde Kernel versions 5.2 to 5.5.
How can DMA attacks be mitigated for CVE-2022-30774?
To mitigate DMA attacks for CVE-2022-30774, it is recommended to apply the necessary security patches provided by Insyde.
Where can I find more information about CVE-2022-30774?
More information about CVE-2022-30774 can be found in the references provided: [SSA-450613.pdf](https://cert-portal.siemens.com/productcert/pdf/ssa-450613.pdf), [Insyde Security Pledge](https://www.insyde.com/security-pledge), [SA-2022043](https://www.insyde.com/security-pledge/SA-2022043).
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/author
- agent/references
- agent/first-publish-date
- agent/event
- agent/description
- agent/tags
- agent/source
- vendor/insyde
- canonical/insyde kernel
- version/insyde kernel/5.2
- version/insyde kernel/5.3
- version/insyde kernel/5.4
- version/insyde kernel/5.5