CVE-2023-22616 Other in n/a
Attackers can corrupt SMRAM via insufficient input validation in the IhisiSmm driver, potentially leading to privilege escalation or code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-22616?
CVE-2023-22616 is a high-severity vulnerability in Insyde Insydeh2o, published on 12 Apr 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An issue was discovered in Insyde InsydeH2O with kernel 5.2 through 5.5. The Save State register is not checked before use. The IhisiSmm driver does not check the value of a save state register before use. Due to insufficient input validation, an attacker can corrupt SMRAM.
Weakness: CWE-610
Which versions are affected by CVE-2023-22616?
It affects 1 product.
Products include Insyde Insydeh2o.
How do I fix CVE-2023-22616?
No fix has been published for CVE-2023-22616 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-22616 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-22616 exists.
Other vulnerabilities in Insyde Insydeh2o
Sources
Also known as GHSA-f9jq-jhvv-4xmw.