CVE-2023-22614: Input Validation
First published: Tue Apr 11 2023(Updated: )
An issue was discovered in ChipsetSvcSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. There is insufficient input validation in BIOS Guard updates. An attacker can induce memory corruption in SMM by supplying malformed inputs to the BIOS Guard SMI handler.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Insyde InsydeH2O | =05.42.52.0026 | |
| Insyde InsydeH2O | =05.43.01.0026 | |
| Insyde InsydeH2O | =05.43.12.0056 | |
| Insyde InsydeH2O | =05.44.34.0054 | |
| Insyde InsydeH2O | =05.44.45.0015 | |
| Insyde InsydeH2O | =05.44.45.0028 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the CVE ID of this vulnerability?
The CVE ID of this vulnerability is CVE-2023-22614.
What is the severity of CVE-2023-22614?
The severity of CVE-2023-22614 is high with a CVSS score of 8.8.
What is the affected software?
The affected software is Insyde InsydeH2O versions 05.42.52.0026, 05.43.01.0026, 05.43.12.0056, 05.44.34.0054, 05.44.45.0015, and 05.44.45.0028.
What is the CWE of CVE-2023-22614?
The CWE of CVE-2023-22614 is CWE-20 and CWE-787.
How can I mitigate this vulnerability?
To mitigate this vulnerability, apply the latest BIOS Guard updates provided by Insyde.
- collector/nvd-api
- collector/nvd-index
- agent/type
- agent/weakness
- agent/severity
- agent/references
- agent/author
- agent/event
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/insyde
- canonical/insyde insydeh2o
- version/insyde insydeh2o/05.42.52.0026
- version/insyde insydeh2o/05.43.01.0026
- version/insyde insydeh2o/05.43.12.0056
- version/insyde insydeh2o/05.44.34.0054
- version/insyde insydeh2o/05.44.45.0015
- version/insyde insydeh2o/05.44.45.0028