#VU80868 Buffer overflow in InsydeH2O Kernel - CVE-2022-35893

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU80868

#VU80868 Buffer overflow in InsydeH2O Kernel - CVE-2022-35893

Published: September 18, 2023


Vulnerability identifier: #VU80868
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2022-35893
CWE-ID: CWE-119
Exploitation vector: Local access
Exploit availability: No public exploit available
Vulnerable software:
InsydeH2O Kernel
Software vendor:
Insyde Software

Description

The vulnerability allows a local user to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in InsydeH2O in the FvbServicesRuntimeDxe driver. A local administrator can trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Remediation

Install updates from vendor's website.

External links