{"schemaVersion":3,"id":"CVE-2022-28806","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"An issue was discovered on certain Fujitsu LIEFBOOK devices (A3510, U9310, U7511/U7411/U7311, U9311, E5510/E5410, U7510/U7410/U7310, E459/E449) with BIOS versions before v1.09 (A3510), v2.17 (U9310), v2.30 (U7511/U7411/U7311), v2.33 (U9311), v2.23 (E5510), v2.19 (U7510/U7410), v2.13 (U7310), and v1.09 (E459/E449). The FjGabiFlashCoreAbstractionSmm driver registers a Software System Management Interrupt (SWSMI) handler that is not sufficiently validated to ensure that the CommBuffer (or any other communication buffer's nested contents) are not pointing to SMRAM contents. A potential attacker can therefore write fixed data to SMRAM, which could lead to data corruption inside this memory (e.g., change the SMI handler's code or modify SMRAM map structures to break input pointer validation for other SMI handlers). Thus, the attacker could elevate privileges from ring 0 to ring -2 and execute arbitrary code in SMM.","dates":{"published":"2022-05-04T14:10:18.000Z","modified":"2025-11-04T19:13:03.588Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.8,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":7.2,"severity":"high","vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00479,"percentile":0.40005,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0.031000000000000038,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.00448},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00448,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00448,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00448,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00448,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00448,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00448,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00448,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00448,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00448,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00479,"percentile":0.40005}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.00448,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00448,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00448,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00448,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00479,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00479,"percentile":0.40005}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_65EB0328D7BA0883","name":"Exploit Reference (binarly.io)","source":"reference","url":"https://www.binarly.io/advisories","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-787","name":"Out-of-bounds Write","description":"The product writes data past the end, or before the beginning, of the intended buffer.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/787.html"}],"affected":[{"vendor":"fujitsu","product":"lifebook_a3510_firmware","name":"lifebook a3510 firmware","label":"lifebook_a3510_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< 1.09","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.09","eol":null,"hubHref":"/vendor/fujitsu/lifebook_a3510"},{"vendor":"fujitsu","product":"lifebook_e449_firmware","name":"lifebook e449 firmware","label":"lifebook_e449_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< 1.09","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.09","eol":null,"hubHref":"/vendor/fujitsu/lifebook_e449"},{"vendor":"fujitsu","product":"lifebook_e459_firmware","name":"lifebook e459 firmware","label":"lifebook_e459_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< 1.09","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.09","eol":null,"hubHref":"/vendor/fujitsu/lifebook_e459"},{"vendor":"fujitsu","product":"lifebook_e5510_firmware","name":"lifebook e5510 firmware","label":"lifebook_e5510_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< 2.23","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.23","eol":null,"hubHref":"/vendor/fujitsu/lifebook_e5510"},{"vendor":"fujitsu","product":"lifebook_u7310_firmware","name":"lifebook u7310 firmware","label":"lifebook_u7310_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< 2.13","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.13","eol":null,"hubHref":"/vendor/fujitsu/lifebook_u7310"},{"vendor":"fujitsu","product":"lifebook_u7311_firmware","name":"lifebook u7311 firmware","label":"lifebook_u7311_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< 2.30","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.30","eol":null,"hubHref":"/vendor/fujitsu/lifebook_u7311"},{"vendor":"fujitsu","product":"lifebook_u7410_firmware","name":"lifebook u7410 firmware","label":"lifebook_u7410_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< 2.19","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19","eol":null,"hubHref":"/vendor/fujitsu/lifebook_u7410"},{"vendor":"fujitsu","product":"lifebook_u7411_firmware","name":"lifebook u7411 firmware","label":"lifebook_u7411_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< 2.30","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.30","eol":null,"hubHref":"/vendor/fujitsu/lifebook_u7411"},{"vendor":"fujitsu","product":"lifebook_u7510_firmware","name":"lifebook u7510 firmware","label":"lifebook_u7510_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< 2.19","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19","eol":null,"hubHref":"/vendor/fujitsu/lifebook_u7510"},{"vendor":"fujitsu","product":"lifebook_u7511_firmware","name":"lifebook u7511 firmware","label":"lifebook_u7511_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< 2.30","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.30","eol":null,"hubHref":"/vendor/fujitsu/lifebook_u7511"},{"vendor":"fujitsu","product":"lifebook_u9310_firmware","name":"lifebook u9310 firmware","label":"lifebook_u9310_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< 2.17","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.17","eol":null,"hubHref":"/vendor/fujitsu/lifebook_u9310"},{"vendor":"fujitsu","product":"lifebook_u9311_firmware","name":"lifebook u9311 firmware","label":"lifebook_u9311_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 2.33","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 2.33","eol":null,"hubHref":"/vendor/fujitsu/lifebook_u9311"}],"affectedCount":12,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.binarly.io/advisories","label":"www.binarly.io/advisories","hostname":"www.binarly.io","tags":["X Refsource MISC","Exploit","Third Party Advisory"]},{"url":"https://kb.cert.org/vuls/id/796611","label":"kb.cert.org/vuls/id/796611","hostname":"kb.cert.org","tags":["X Refsource MISC","Third Party Advisory","US Government Resource"]},{"url":"https://support.ts.fujitsu.com/ProductSecurity/content/Fujitsu-PSIRT-FCCL-IS-2021-090903-Security-Advisory.asp","label":"support.ts.fujitsu.com/ProductSecurity/…","hostname":"support.ts.fujitsu.com","tags":["X Refsource MISC","Vendor Advisory"]},{"url":"http://www.fmworld.net/biz/common/insyde/20220210/","label":"www.fmworld.net/biz/common/insyde/20220210/","hostname":"www.fmworld.net","tags":["X Refsource MISC","Vendor Advisory"]},{"url":"https://www.kb.cert.org/vuls/id/796611","label":"www.kb.cert.org/vuls/id/796611","hostname":"www.kb.cert.org","tags":[]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2022-05-04T14:10:18.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2025-11-04T19:13:03.588Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":41,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T19:13:28.141Z","stale":false,"partial":false}}