CVE-2023-39283

HIGH

Insyde InsydeH2O 5.0-5.5 - SMM Memory Corruption via CsmInt10HookSmm SMRAM Write

Title source: llm

Description

An SMM memory corruption vulnerability in the SMM driver (SMRAM write) in CsmInt10HookSmm in Insyde InsydeH2O with kernel 5.0 through 5.5 allows attackers to send arbitrary data to SMM which could lead to privilege escalation.

References (2)

Core 2

Core References

Not Applicable

https://www.insyde.com/security-pledge

Vendor Advisory

https://www.insyde.com/security-pledge/SA-2023055

Scores

CVSS v3 7.8

EPSS 0.0019

EPSS Percentile 9.3%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-787

Status published

Products (4)

insyde/insydeh2o 5.5.05.53.22

insyde/insydeh2o 5.6

insyde/insydeh2o 5.6.05.60.22

insyde/insydeh2o 5.0 - 5.5

Published Nov 02, 2023

Tracked Since Feb 18, 2026