CVE-2022-35407

 

Published at: - 22-11-2022 03:15

Last modified: - 22-11-2022 02:44

Total changes: - 1

Description

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. A stack buffer overflow leads to arbitrary code execution in the SetupUtility driver on Intel platforms. An attacker can change the values of certain UEFI variables. If the size of the second variable exceeds the size of the first, then the buffer will be overwritten. This issue affects the SetupUtility driver of InsydeH2O.

Common Vulnerability Scoring System (CVSS)

-

 

Verification logic

 

Reference

• https://www.insyde.com/security-pledge
• https://www.insyde.com/security-pledge/SA-2022040

 

Keywords

NVD

 

CVE-2022-35407

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures