Insyde Kernel up to 5.5 UEFI Variable the stack-based overflow

Summaryinfo

A vulnerability labeled as critical has been found in Insyde Kernel up to 5.5. Impacted is an unknown function of the component UEFI Variable Handler. The manipulation of the argument the results in stack-based overflow. This vulnerability was named CVE-2022-35897. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in Insyde Kernel up to 5.5. It has been classified as critical. Affected is an unknown part of the component UEFI Variable Handler. The manipulation of the argument the with an unknown input leads to a stack-based overflow vulnerability. CWE is classifying the issue as CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

An stack buffer overflow vulnerability leads to arbitrary code execution issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. If the attacker modifies specific UEFI variables, it can cause a stack overflow, leading to arbitrary code execution. The specific variables are normally locked (read-only) at the OS level and therefore an attack would require direct SPI modification. If an attacker can change the values of at least two variables out of three (SecureBootEnforce, SecureBoot, RestoreBootSettings), it is possible to execute arbitrary code.

The weakness was presented 11/21/2022. The advisory is available at insyde.com. This vulnerability is traded as CVE-2022-35897 since 07/15/2022. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 06/16/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2022-38770). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Insyde

Name

• Kernel

Version

• 5.0
• 5.1
• 5.2
• 5.3
• 5.4
• 5.5

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion