Memory leak in InsydeH2O Kernel - CVE-2022-35896

Vulnerability identifier: #VU80873

CSH Severity: Low

CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-35896

CWE-ID: CWE-401

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due memory leak in SMM driver (SMRAM read) in InsydeH2O. A local administrator can force the application to leak memory and gain access to sensitive information on the target system.

InsydeH2O Kernel
RUGGEDCOM APE1808CLA-P CC
RUGGEDCOM APE1808W10 CC
RUGGEDCOM APE1808W10
RUGGEDCOM APE1808LNX CC
RUGGEDCOM APE1808LNX
RUGGEDCOM APE1808CLA-S5 CC
RUGGEDCOM APE1808CLA-S5
RUGGEDCOM APE1808CLA-S3 CC
RUGGEDCOM APE1808CLA-S3
RUGGEDCOM APE1808CLA-S1 CC
RUGGEDCOM APE1808CLA-S1
RUGGEDCOM APE1808 ADM
RUGGEDCOM APE1808CLA-P
RUGGEDCOM APE1808 SAM-L CC
RUGGEDCOM APE1808 SAM-L
RUGGEDCOM APE1808 ELAN CC
RUGGEDCOM APE1808 ELAN
RUGGEDCOM APE1808 CLOUDCONNECT CC
RUGGEDCOM APE1808 CLOUDCONNECT
RUGGEDCOM APE1808 CKP CC
RUGGEDCOM APE1808 CKP
RUGGEDCOM APE1808 ADM CC

Install updates from vendor's website.

InsydeH2O Kernel - addressed in versions 5.0 05.09.37, 5.1 05.17.37, 5.2 05.27.29, 5.3 05.36.29, 5.4 05.44.29, 5.5 05.52.29
RUGGEDCOM APE1808CLA-P CC - update to 1.0.212N
RUGGEDCOM APE1808W10 CC - update to 1.0.212N
RUGGEDCOM APE1808W10 - update to 1.0.212N
RUGGEDCOM APE1808LNX CC - update to 1.0.212N
RUGGEDCOM APE1808LNX - update to 1.0.212N
RUGGEDCOM APE1808CLA-S5 CC - update to 1.0.212N
RUGGEDCOM APE1808CLA-S5 - update to 1.0.212N
RUGGEDCOM APE1808CLA-S3 CC - update to 1.0.212N
RUGGEDCOM APE1808CLA-S3 - update to 1.0.212N
RUGGEDCOM APE1808CLA-S1 CC - update to 1.0.212N
RUGGEDCOM APE1808CLA-S1 - update to 1.0.212N
RUGGEDCOM APE1808 ADM - update to 1.0.212N
RUGGEDCOM APE1808CLA-P - update to 1.0.212N
RUGGEDCOM APE1808 SAM-L CC - update to 1.0.212N
RUGGEDCOM APE1808 SAM-L - update to 1.0.212N
RUGGEDCOM APE1808 ELAN CC - update to 1.0.212N
RUGGEDCOM APE1808 ELAN - update to 1.0.212N
RUGGEDCOM APE1808 CLOUDCONNECT CC - update to 1.0.212N
RUGGEDCOM APE1808 CLOUDCONNECT - update to 1.0.212N
RUGGEDCOM APE1808 CKP CC - update to 1.0.212N
RUGGEDCOM APE1808 CKP - update to 1.0.212N
RUGGEDCOM APE1808 ADM CC - update to 1.0.212N

• https://www.insyde.com/security-pledge/SA-2022034
• https://www.insyde.com/security-pledge
• https://binarly.io/advisories/BRLY-2022-025/index.html

• Multiple vulnerabilities in Insyde Kernel
• Multiple vulnerabilities in Siemens RUGGEDCOM APE1808 Product Family