VULNERABILITY INTELLIGENCE

CVE-2022-32471

CVSS score7 HIGH
EPSS probability0.13%
CISA KEVNot currently listed
Published2023-02-15
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. The IhisiDxe driver uses the command buffer to pass input and output data. By modifying the command buffer contents with DMA after the input parameters have been checked but before they are used, the IHISI SMM code may be convinced to modify SMRAM or OS, leading to possible data corruption or escalation of privileges.

Weakness classification

  • nvd@nist.gov: CWE-367
  • 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-367

Primary references