CVE-2022-35897 Memory corruption in n/a
Stack buffer overflow in InsydeH2O UEFI firmware allows arbitrary code execution if an attacker can modify specific locked variables via SPI access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-35897?
CVE-2022-35897 is a medium-severity memory corruption vulnerability in n/a, published on 21 Nov 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An stack buffer overflow vulnerability leads to arbitrary code execution issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. If the attacker modifies specific UEFI variables, it can cause a stack overflow, leading to arbitrary code execution. The specific variables are normally locked (read-only) at the OS level and therefore an attack would require direct SPI modification. If an attacker can change the values of at least two variables out of three (SecureBootEnforce, SecureBoot, RestoreBootSettings), it is possible to execute arbitrary code.
Weakness: CWE-787
Which versions are affected by CVE-2022-35897?
It affects 1 product.
Products include Insyde Kernel.
How do I fix CVE-2022-35897?
No fix has been published for CVE-2022-35897 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-35897 being exploited?
There is no known exploitation of CVE-2022-35897 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-9g2j-3rfj-c298.