CVE-2023-22613: insyde insydeh2o Out-of-bounds Write

Vulnerability summary

CVE-2023-22613 is a high (CVSS 8.8) Out-of-bounds Write vulnerability in insyde insydeh2o. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 10.9% of scored vulnerabilities.

Timeline

1. 11-04-2023
   PublishedVulnerability first disclosed.
2. 11-02-2025
   Last modifiedVulnerability information updated.

Description

An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. It is possible to write to an attacker-controlled address. An attacker could invoke an SMI handler with a malformed pointer in RCX that overlaps SMRAM, resulting in SMM memory corruption.

• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.