Memory Corruption Vulnerability in InsydeH2O Kernel and Affected Products
CVE-2024-27353

7.4HIGH

Key Information:

Vendor

Insyde Software Corp.

Vendor
CVE Published:
15 May 2024

What is CVE-2024-27353?

A memory corruption vulnerability discovered in the SdHost and SdMmcDevice components of InsydeH2O kernel allows for potential privilege escalation within System Management Mode (SMM). The issue affects several versions of the InsydeH2O kernel, specifically versions prior to 05.29.09 for 5.2, 05.38.09 for 5.3, 05.46.09 for 5.4, 05.54.09 for 5.5, and 05.61.09 for 5.6. This vulnerability poses a significant risk as it can allow attackers to exploit memory corruption methods to gain unauthorized access to higher privileges within the system. Users are advised to review the latest patches from Insyde Software and ensure that their systems are updated to mitigate this security risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://www.insyde.com/security-pledge
https://www.insyde.com/security-pledge/SA-2024001

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

JSON
.