CVE-2022-35408: insyde insydeh2o Write-what-where Condition

Vulnerability summary

CVE-2022-35408 is a high (CVSS 8.2) Write-what-where Condition vulnerability in insyde insydeh2o. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 29.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 22-09-2022
   PublishedVulnerability first disclosed.
2. 27-05-2025
   Last modifiedVulnerability information updated.

Description

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An SMM callout vulnerability in the SMM driver in UsbLegacyControlSmm leads to possible arbitrary code execution in SMM and escalation of privileges. An attacker could overwrite the function pointers in the EFI_BOOT_SERVICES table before the USB SMI handler triggers. (This is not exploitable from code running in the operating system.)

• CWE-123Write-what-where ConditionAny condition where the attacker has the ability to write an arbitrary value to an arbitrary location, often as the result of a buffer overflow.