CVE-2023-22615: High severity insyde h2o vulnerability
An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. IHISI subfunction execution may corrupt SMRAM. An attacker can pass an address in the RCX save state register that overlaps SMRAM, thereby coercing an IHISI subfunction handler to overwrite private SMRAM.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-22615?
The severity of CVE-2023-22615 is high with a score of 8.4.
What is the description of CVE-2023-22615?
CVE-2023-22615 is an issue in IhisiSmm in Insyde InsydeH2O that can corrupt SMRAM when executing IHISI subfunction. An attacker can overwrite private SMRAM by passing an address in the RCX save state register that overlaps with SMRAM.
Which software versions are affected by CVE-2023-22615?
Insyde InsydeH2O versions 05.37.03, 05.45.01, and 05.53.01 are affected by CVE-2023-22615.
How can an attacker exploit CVE-2023-22615?
An attacker can exploit CVE-2023-22615 by passing an address in the RCX save state register that overlaps SMRAM, coercing an IHISI subfunction handler to overwrite private SMRAM.
Is there a security pledge or advisory for CVE-2023-22615?
Yes, there is a security pledge and advisory available for CVE-2023-22615. You can find more information at the following links: [Security Pledge](https://www.insyde.com/security-pledge) and [SA-2023021](https://www.insyde.com/security-pledge/SA-2023021).