CVE-2022-32471 is a high-severity vulnerability affecting Insyde InsydeH2O firmware kernels 5.0 through 5.5. It allows an attacker to manipulate the IhisiDxe driver's command buffer via DMA after input validation, potentially leading to SMRAM or OS data corruption and privilege escalation. The attack requires local access and high attack complexity, but no user interaction. Currently, there is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 5.0, < 5.2.05.27.37CPE matchmatch criteria | cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:* | ||
>= 5.3, < 5.3.05.36.37CPE matchmatch criteria | cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:* | ||
>= 5.4, < 5.4.05.44.45CPE matchmatch criteria | cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:* | ||
>= 5.5, < 5.5.05.52.45CPE matchmatch criteria | cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.4 InfoSec Media, 0.1 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.