CVE-2022-33909
First published: Mon Nov 14 2022(Updated: )
DMA transactions which are targeted at input buffers used for the HddPassword software SMI handler could cause SMRAM corruption through a TOCTOU attack. DMA transactions which are targeted at input buffers used for the software SMI handler used by the HddPassword driver could cause SMRAM corruption through a TOCTOU attack..This issue was discovered by Insyde engineering based on the general description provided by Intel's iSTARE group. Fixed in kernel Kernel 5.2: 05.27.23, Kernel 5.3: 05.36.23, Kernel 5.4: 05.44.23, Kernel 5.5: 05.52.23 https://www.insyde.com/security-pledge/SA-2022051
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Insyde Kernel | >=5.2<5.2.05.27.23 | |
| Insyde Kernel | >=5.3<5.3.05.36.23 | |
| Insyde Kernel | >=5.4<5.4.05.44.23 | |
| Insyde Kernel | >=5.5<5.5.05.52.23 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-33909?
CVE-2022-33909 is a vulnerability that allows DMA transactions targeted at input buffers used for the HddPassword software SMI handler to cause SMRAM corruption through a TOCTOU attack.
How does CVE-2022-33909 affect Insyde Kernel?
CVE-2022-33909 affects Insyde Kernel versions 5.2 to 5.5 used by the HddPassword driver and could cause SMRAM corruption.
What is SMRAM corruption?
SMRAM corruption refers to the alteration of the System Management RAM (SMRAM) that can lead to unauthorized access or control over a system.
What is a TOCTOU attack?
A TOCTOU (Time-of-Check, Time-of-Use) attack is a type of race condition where changes made to a resource between the time it is checked and the time it is used can result in unauthorized or unexpected behavior.
How can I mitigate the CVE-2022-33909 vulnerability?
To mitigate the CVE-2022-33909 vulnerability, it is recommended to apply the security patches provided by Insyde and keep the Insyde Kernel up to date.
- collector/nvd-index
- agent/severity
- agent/weakness
- agent/references
- agent/author
- agent/description
- agent/type
- agent/event
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/insyde
- canonical/insyde kernel
- version/insyde kernel/5.2
- version/insyde kernel/5.3
- version/insyde kernel/5.4
- version/insyde kernel/5.5