CVE-2022-32267

DMA transactions which are targeted at input buffers used for the SmmResourceCheckDxe software SMI handler cause SMRAM corruption (a TOCTOU attack) DMA transactions which are targeted at input buffers used for the software SMI handler used by the SmmResourceCheckDxe driver could cause SMRAM corruption through a TOCTOU attack... This issue was discovered by Insyde engineering. Fixed in kernel Kernel 5.2: 05.27.23. Kernel 5.3: 05.36.23. Kernel 5.4: 05.44.23. Kernel 5.5: 05.52.23 https://www.insyde.com/security-pledge/SA-2022046

CVSS v3 6.4 MEDIUM

6.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.5 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.insyde.com/security-pledge	Vendor Advisory
https://www.insyde.com/security-pledge/SA-2022046	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:insyde:kernel::::::::
	cpe:2.3:a:insyde:kernel::::::::
	cpe:2.3:a:insyde:kernel::::::::
	cpe:2.3:a:insyde:kernel::::::::

History

No history.

Information

Published : 2022-11-15 00:15

Updated : 2024-02-28 19:29

NVD link : CVE-2022-32267

Mitre link : CVE-2022-32267

CVE.ORG link : CVE-2022-32267

JSON object : View

Products Affected

insyde

kernel

CWE

CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

{"id": "CVE-2022-32267", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.5}]}, "published": "2022-11-15T00:15:11.610", "references": [{"url": "https://www.insyde.com/security-pledge", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.insyde.com/security-pledge/SA-2022046", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-367"}]}], "descriptions": [{"lang": "en", "value": "DMA transactions which are targeted at input buffers used for the SmmResourceCheckDxe software SMI handler cause SMRAM corruption (a TOCTOU attack) DMA transactions which are targeted at input buffers used for the software SMI handler used by the SmmResourceCheckDxe driver could cause SMRAM corruption through a TOCTOU attack... This issue was discovered by Insyde engineering. Fixed in kernel Kernel 5.2: 05.27.23. Kernel 5.3: 05.36.23. Kernel 5.4: 05.44.23. Kernel 5.5: 05.52.23 https://www.insyde.com/security-pledge/SA-2022046"}, {"lang": "es", "value": "Las transacciones DMA que est\u00e1n dirigidas a los b\u00faferes de entrada utilizados para el controlador SMI del software SmmResourceCheckDxe causan corrupci\u00f3n de SMRAM (un ataque TOCTOU) Las transacciones DMA que est\u00e1n dirigidas a los b\u00faferes de entrada utilizados para el controlador SMI del software utilizado por el controlador SmmResourceCheckDxe podr\u00edan causar corrupci\u00f3n de SMRAM a trav\u00e9s de un ataque TOCTOU ... Este problema fue descubierto por la ingenier\u00eda de Insyde. Corregido en el kernel Kernel 5.2: 27.05.23. N\u00facleo 5.3: 36.05.23. N\u00facleo 5.4: 05.44.23. N\u00facleo 5.5: 05.52.23 https://www.insyde.com/security-pledge/SA-2022046"}], "lastModified": "2022-11-18T16:01:30.513", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:insyde:kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "94BB75BA-F075-45A2-AD76-BA8DCA2F4CEF", "versionEndExcluding": "5.2.05.27.23", "versionStartIncluding": "5.2"}, {"criteria": "cpe:2.3:a:insyde:kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B164BDEE-BE93-4EB5-89E7-AB2D63512CA6", "versionEndExcluding": "5.3.05.36.23", "versionStartIncluding": "5.3"}, {"criteria": "cpe:2.3:a:insyde:kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A5CC2DFA-DE56-4615-8F35-84F3ACD3B541", "versionEndExcluding": "5.4.05.44.23", "versionStartIncluding": "5.4"}, {"criteria": "cpe:2.3:a:insyde:kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9786B2BB-8754-4BA4-868E-FA2468D13AD2", "versionEndExcluding": "5.5.05.52.23", "versionStartIncluding": "5.5"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}