Insyde's Security Pledge

Recent Security Advisories

INSYDE-SA-2023022

Product

CVSS Score

Original Date

Last Revised

InsydeH2O

6.4

2023-04-10

Summary

IhisiServicesSmm: Save State Register Not Checked Before Use.

Vulnerability Details

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:L

CVE-2023-22616

Due to insufficient input validation, an attacker can corrupt SMRAM.

Solution Information

Intel Mobile platforms:

RPL: Version 05.44.20.0010
ADL-N: Version 05.44.23.0011
ADL: Version 05.44.20.0045
RKL: Version 05.42.52.0024
TGL: Version 05.43.12.0056
JSL: Version 05.43.01.0025

Intel Server/Embedded platforms:

Mehlow/Mehlow-R(CFL-S) : Version 05.23.04.0050
Tatlow (RKS) :Version 05.42.52.0024
WhiskeyLake : Version 05.23.45.0028
CometLake-S : Version 05.34.19.0044
TigerLake UP3/H : Version 05.43.12.0052
AlderLake : Version 05.44.23.0047
ElkhartLake : Version 05.44.30.0018
Alder Lake N : Version 05.44.34.0001

AMD platforms:

ROME : Trunk
MILAN : Version 05.37.03.0020
GENOA : Master
Ryzen 5000 : IB20080004 @ Trunk
EmbROME : IB06170334 @ Trunk
EmbMILAN : IB06170335 @ Trunk

Acknowledgements

Insyde Software would like to thank Jeremy Boone (@uffeux) of the NCC Group for reporting the vulnerability and engaging in this coordinated disclosure.

Revision History

Revision #

Date

Description

1

2023-04-10

Initial Release