Insyde's Security Pledge
Recent Security Advisories

INSYDE-SA-2023022
Product
CVSS Score
Original Date
Last Revised
InsydeH2O
6.4
2023-04-10
Summary
IhisiServicesSmm: Save State Register Not Checked Before Use.
Vulnerability Details
CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:L
Due to insufficient input validation, an attacker can corrupt SMRAM.
Solution Information
Intel Mobile platforms:
RPL: Version 05.44.20.0010
ADL-N: Version 05.44.23.0011
ADL: Version 05.44.20.0045
RKL: Version 05.42.52.0024
TGL: Version 05.43.12.0056
JSL: Version 05.43.01.0025
Intel Server/Embedded platforms:
Mehlow/Mehlow-R(CFL-S) : Version 05.23.04.0050
Tatlow (RKS) :Version 05.42.52.0024
WhiskeyLake : Version 05.23.45.0028
CometLake-S : Version 05.34.19.0044
TigerLake UP3/H : Version 05.43.12.0052
AlderLake : Version 05.44.23.0047
ElkhartLake : Version 05.44.30.0018
Alder Lake N : Version 05.44.34.0001
AMD platforms:
ROME : Trunk
MILAN : Version 05.37.03.0020
GENOA : Master
Ryzen 5000 : IB20080004 @ Trunk
EmbROME : IB06170334 @ Trunk
EmbMILAN : IB06170335 @ Trunk
Acknowledgements
Insyde Software would like to thank Jeremy Boone (@uffeux) of the NCC Group for reporting the vulnerability and engaging in this coordinated disclosure.
Revision History
Revision #
Date
Description
1
2023-04-10
Initial Release