CVE-2022-35896

MEDIUM

Insyde InsydeH2O 5.0-5.5 - SMM Memory Leak via FvbServicesRuntimeDxe Driver

Title source: llm

Description

An issue SMM memory leak vulnerability in SMM driver (SMRAM was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An attacker can dump SMRAM contents via the software SMI provided by the FvbServicesRuntimeDxe driver to read the contents of SMRAM, leading to information disclosure.

References (3)

Core 3

Core References

Vendor Advisory x_refsource_misc

https://www.insyde.com/security-pledge

Vendor Advisory x_refsource_misc

https://www.insyde.com/security-pledge/SA-2022034

Exploit, Third Party Advisory x_refsource_misc

https://binarly.io/advisories/BRLY-2022-025/index.html

Scores

CVSS v3 6.0

EPSS 0.0031

EPSS Percentile 22.5%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-20

Status published

Products (1)

insyde/insydeh2o 5.0 - 5.5

Published Sep 22, 2022

Tracked Since Feb 18, 2026