Out-of-bounds write in InsydeH2O Kernel - CVE-2022-35895

Vulnerability identifier: #VU80872

CSH Severity: Low

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-35895

CWE-ID: CWE-787

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input in SMM driver (SMRAM write) in InsydeH2O. A local administrator can trigger an out-of-bounds write and execute arbitrary code on the target system.

InsydeH2O Kernel
RUGGEDCOM APE1808CLA-P CC
RUGGEDCOM APE1808W10 CC
RUGGEDCOM APE1808W10
RUGGEDCOM APE1808LNX CC
RUGGEDCOM APE1808LNX
RUGGEDCOM APE1808CLA-S5 CC
RUGGEDCOM APE1808CLA-S5
RUGGEDCOM APE1808CLA-S3 CC
RUGGEDCOM APE1808CLA-S3
RUGGEDCOM APE1808CLA-S1 CC
RUGGEDCOM APE1808CLA-S1
RUGGEDCOM APE1808 ADM
RUGGEDCOM APE1808CLA-P
RUGGEDCOM APE1808 SAM-L CC
RUGGEDCOM APE1808 SAM-L
RUGGEDCOM APE1808 ELAN CC
RUGGEDCOM APE1808 ELAN
RUGGEDCOM APE1808 CLOUDCONNECT CC
RUGGEDCOM APE1808 CLOUDCONNECT
RUGGEDCOM APE1808 CKP CC
RUGGEDCOM APE1808 CKP
RUGGEDCOM APE1808 ADM CC

Install updates from vendor's website.

InsydeH2O Kernel - addressed in versions 5.0 05.09.37, 5.1 05.17.37, 5.2 05.27.29, 5.3 05.36.29, 5.4 05.44.29, 5.5 05.52.29
RUGGEDCOM APE1808CLA-P CC - update to 1.0.212N
RUGGEDCOM APE1808W10 CC - update to 1.0.212N
RUGGEDCOM APE1808W10 - update to 1.0.212N
RUGGEDCOM APE1808LNX CC - update to 1.0.212N
RUGGEDCOM APE1808LNX - update to 1.0.212N
RUGGEDCOM APE1808CLA-S5 CC - update to 1.0.212N
RUGGEDCOM APE1808CLA-S5 - update to 1.0.212N
RUGGEDCOM APE1808CLA-S3 CC - update to 1.0.212N
RUGGEDCOM APE1808CLA-S3 - update to 1.0.212N
RUGGEDCOM APE1808CLA-S1 CC - update to 1.0.212N
RUGGEDCOM APE1808CLA-S1 - update to 1.0.212N
RUGGEDCOM APE1808 ADM - update to 1.0.212N
RUGGEDCOM APE1808CLA-P - update to 1.0.212N
RUGGEDCOM APE1808 SAM-L CC - update to 1.0.212N
RUGGEDCOM APE1808 SAM-L - update to 1.0.212N
RUGGEDCOM APE1808 ELAN CC - update to 1.0.212N
RUGGEDCOM APE1808 ELAN - update to 1.0.212N
RUGGEDCOM APE1808 CLOUDCONNECT CC - update to 1.0.212N
RUGGEDCOM APE1808 CLOUDCONNECT - update to 1.0.212N
RUGGEDCOM APE1808 CKP CC - update to 1.0.212N
RUGGEDCOM APE1808 CKP - update to 1.0.212N
RUGGEDCOM APE1808 ADM CC - update to 1.0.212N

• https://binarly.io/advisories/BRLY-2022-024/index.html
• https://www.insyde.com/security-pledge/SA-2022033
• https://www.insyde.com/security-pledge

• Multiple vulnerabilities in Insyde Kernel
• Multiple vulnerabilities in Siemens RUGGEDCOM APE1808 Product Family