SB2023091908 - Multiple vulnerabilities in Insyde Kernel

Description

This security bulletin contains information about 3 vulnerabilities.

1) Memory leak (CVE-ID: CVE-2022-35894)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due memory leak in SMM driver (SMRAM read) in InsydeH2O. A local administrator can force the application to leak memory and gain access to sensitive information on the target system.

2) Memory leak (CVE-ID: CVE-2022-35896)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due memory leak in SMM driver (SMRAM read) in InsydeH2O. A local administrator can force the application to leak memory and gain access to sensitive information on the target system.

3) Out-of-bounds write (CVE-ID: CVE-2022-35895)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input in SMM driver (SMRAM write) in InsydeH2O. A local administrator can trigger an out-of-bounds write and execute arbitrary code on the target system.

Remediation

Install update from vendor's website.

References

• https://www.insyde.com/security-pledge
• https://www.insyde.com/security-pledge/SA-2022030
• https://binarly.io/advisories/BRLY-2022-018/index.html
• https://www.insyde.com/security-pledge/SA-2022034
• https://binarly.io/advisories/BRLY-2022-025/index.html
• https://binarly.io/advisories/BRLY-2022-024/index.html
• https://www.insyde.com/security-pledge/SA-2022033