CVE-2022-32471

HIGH

Insyde InsydeH2O 5.0-5.5 - Time-of-check Time-of-use Race Condition in IhisiSmm via DMA Command Buffer Manipulation

Title source: llm
STIX 2.1

Description

An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. The IhisiDxe driver uses the command buffer to pass input and output data. By modifying the command buffer contents with DMA after the input parameters have been checked but before they are used, the IHISI SMM code may be convinced to modify SMRAM or OS, leading to possible data corruption or escalation of privileges.

References (2)

Core 2

Scores

CVSS v3 7.0
EPSS 0.0013
EPSS Percentile 3.1%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-367
Status published
Products (1)
insyde/insydeh2o 5.0 - 5.2.05.27.37
Published Feb 15, 2023
Tracked Since Feb 18, 2026