CVE-2023-28468: Medium severity insyde kernel vulnerability
An issue was discovered in FvbServicesRuntimeDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. The FvbServicesRuntimeDxe SMM module exposes an SMI handler that allows an attacker to interact with the SPI flash at run-time from the OS.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2023-28468.
What is the severity of CVE-2023-28468?
The severity of CVE-2023-28468 is medium with a severity value of 6.5.
What software is affected by CVE-2023-28468?
The Insyde Kernel versions 5.0 through 5.5 are affected by CVE-2023-28468.
How can an attacker exploit CVE-2023-28468?
An attacker can exploit CVE-2023-28468 by interacting with the SPI flash at run-time from the OS through the SMI handler exposed by the FvbServicesRuntimeDxe SMM module.
Are there any references available for CVE-2023-28468?
Yes, you can find references for CVE-2023-28468 at the following links: [link1](https://www.insyde.com/security-pledge/SA-2023039), [link2](https://www.insyde.com/security-pledge).