Memory Corruption Vulnerability in InsydeH2O Firmware
CVE-2024-25078

7.4HIGH

Key Information:

Vendor

Insyde Software

Status
Kernel
Vendor
CVE Published:
15 May 2024

What is CVE-2024-25078?

A memory corruption vulnerability exists within the StorageSecurityCommandDxe module of InsydeH2O firmware, which can lead to privilege escalation within System Management Mode (SMM). This vulnerability impacts multiple kernel versions, specifically versions 5.2 through 5.6, prior to specific builds. Successful exploitation could allow an attacker to manipulate system-level functions, potentially compromising sensitive operations and leading to unauthorized access. Addressing this issue requires updating firmware to secure builds as outlined in Insyde's security pledges.

References

https://www.insyde.com/security-pledge
https://www.insyde.com/security-pledge/SA-2024001

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

.