Description

DMA attacks on the parameter buffer used by the IhisiSmm driver could change the contents after parameter values have been checked but before they are used (a TOCTOU attack). DMA attacks on the parameter buffer used by the IhisiSmm driver could change the contents after parameter values have been checked but before they are used (a TOCTOU attack). This issue was discovered by Insyde engineering. This issue is fixed in Kernel 5.4: 05.44.23 and Kernel 5.5: 05.52.23. CWE-367

Related CPE's

a

insyde

kernel

2

References

https://www.insyde.com/security-pledge

Vendor Advisory

https://www.insyde.com/security-pledge/SA-2022042

Vendor Advisory

Weaknesses

[email protected]

Primary
CWE-367

CVSS impact metrics

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

6.4 · Medium

  • CVSS V3.1

  • CVSS V3.0

  • CVSS V2.0

Information

Source identifier

[email protected]

Vulnerability status

Analyzed

Published

2022-11-14T22:15:13.373

2 years ago

Last modified

2022-11-18T16:01:54.213

2 years ago