DeutschShown in its original language — a full translation is planned for a future version.
Insyde UEFI Firmware und Lenovo BIOS: Mehrere Schwachstellen
view advisory published 2024-03-12
Ein lokaler Angreifer kann mehrere Schwachstellen in Insyde UEFI Firmware und Lenovo BIOS ausnutzen, um Dateien zu manipulieren, beliebigen Code auszuführen oder seine Privilegien zu erweitern.
01
describes (4)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-28149US | — | — | ||
An issue was discovered in the IhisiServiceSmm module in Insyde InsydeH2O with kernel 5.2 before 05.28.42, 5.3 before 05.37.42, 5.4 before 05.45.39, 5.5 before 05.53.39, and 5.6 be… | ||||
| CVE-2023-39283US | high7.8 | — | ||
An SMM memory corruption vulnerability in the SMM driver (SMRAM write) in CsmInt10HookSmm in Insyde InsydeH2O with kernel 5.0 through 5.5 allows attackers to send arbitrary data to… | ||||
| CVE-2023-39284US | medium5.5 | — | ||
An issue was discovered in IhisiServicesSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. There are arbitrary calls to SetVariable with unsanitized arguments in the SMI handler. | ||||
| CVE-2023-39281US | critical9.8 | — | ||
A stack buffer overflow vulnerability discovered in AsfSecureBootDxe in Insyde InsydeH2O with kernel 5.0 through 5.5 allows attackers to run arbitrary code execution during the DXE… | ||||
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan