CVE-2023-40238: Medium severity Fujitsu Esprimo D556\/2 Firmware vulnerability
A LogoFAIL issue was discovered in BmpDecoderDxe in Insyde InsydeH2O with kernel 5.2 before 05.28.47, 5.3 before 05.37.47, 5.4 before 05.45.47, 5.5 before 05.53.47, and 5.6 before 05.60.47 for certain Lenovo devices. Image parsing of crafted BMP logo files can copy data to a specific address during the DXE phase of UEFI execution. This occurs because of an integer signedness error involving PixelHeight and PixelWidth during RLE4/RLE8 compression.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-40238?
CVE-2023-40238 has a high severity rating due to its potential to compromise system integrity.
How do I fix CVE-2023-40238?
To fix CVE-2023-40238, update the InsydeH2O UEFI BIOS to a version greater than 5.2.05.28.47, 5.3.05.37.47, 5.4.05.45.47, 5.5.05.53.47, or 5.6.05.60.47.
Which devices are affected by CVE-2023-40238?
CVE-2023-40238 affects certain Lenovo devices utilizing Insyde InsydeH2O UEFI BIOS with specified version ranges.
What type of issue is represented by CVE-2023-40238?
CVE-2023-40238 represents a LogoFAIL issue specifically related to image parsing of crafted BMP logo files.
When was CVE-2023-40238 disclosed?
CVE-2023-40238 was disclosed in late 2023 alongside its associated risk specifications.