CVE-2022-35897: Buffer Overflow
An stack buffer overflow vulnerability leads to arbitrary code execution issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. If the attacker modifies specific UEFI variables, it can cause a stack overflow, leading to arbitrary code execution. The specific variables are normally locked (read-only) at the OS level and therefore an attack would require direct SPI modification. If an attacker can change the values of at least two variables out of three (SecureBootEnforce, SecureBoot, RestoreBootSettings), it is possible to execute arbitrary code.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-35897.
What is the severity of CVE-2022-35897?
The severity of CVE-2022-35897 is medium with a CVSS score of 6.8.
What is the affected software for CVE-2022-35897?
The affected software for CVE-2022-35897 is Insyde InsydeH2O with kernel versions 5.0 through 5.5.
How does CVE-2022-35897 exploit occur?
CVE-2022-35897 exploits a stack buffer overflow vulnerability in Insyde InsydeH2O when specific UEFI variables are modified, causing a stack overflow and leading to arbitrary code execution.
Are there any references for CVE-2022-35897?
Yes, you can find additional details about CVE-2022-35897 in the following references: [Link 1](https://www.insyde.com/security-pledge) and [Link 2](https://www.insyde.com/security-pledge/SA-2022041).