CVE-2022-31243

Update description and links DMA transactions which are targeted at input buffers used for the software SMI handler used by the FvbServicesRuntimeDxe driver could cause SMRAM corruption through a TOCTOU attack.. "DMA transactions which are targeted at input buffers used for the software SMI handler used by the FvbServicesRuntimeDxe driver could cause SMRAM corruption. This issue was discovered by Insyde engineering based on the general description provided by Intel's iSTARE group. Fixed in Kernel 5.2: 05.27.21. Kernel 5.3: 05.36.21. Kernel 5.4: 05.44.21. Kernel 5.5: 05.52.21 https://www.insyde.com/security-pledge/SA-2022044

CVSS v3 6.4 MEDIUM

6.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.5 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://cert-portal.siemens.com/productcert/pdf/ssa-450613.pdf
https://www.insyde.com/security-pledge	Vendor Advisory
https://www.insyde.com/security-pledge/SA-2022044	Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-450613.pdf
https://www.insyde.com/security-pledge	Vendor Advisory
https://www.insyde.com/security-pledge/SA-2022044	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:insyde:kernel::::::::
	cpe:2.3:a:insyde:kernel::::::::
	cpe:2.3:a:insyde:kernel::::::::
	cpe:2.3:a:insyde:kernel::::::::

History

21 Nov 2024, 07:04

Type	Values Removed	Values Added
References	~~() https://cert-portal.siemens.com/productcert/pdf/ssa-450613.pdf -~~	() https://cert-portal.siemens.com/productcert/pdf/ssa-450613.pdf -
References	~~() https://www.insyde.com/security-pledge - Vendor Advisory~~	() https://www.insyde.com/security-pledge - Vendor Advisory
References	~~() https://www.insyde.com/security-pledge/SA-2022044 - Vendor Advisory~~	() https://www.insyde.com/security-pledge/SA-2022044 - Vendor Advisory

Information

Published : 2022-11-15 00:15

Updated : 2025-04-30 20:15

NVD link : CVE-2022-31243

Mitre link : CVE-2022-31243

CVE.ORG link : CVE-2022-31243

JSON object : View

Products Affected

insyde

kernel

CWE

CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

{"id": "CVE-2022-31243", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.5}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.5}]}, "published": "2022-11-15T00:15:11.377", "references": [{"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-450613.pdf", "source": "cve@mitre.org"}, {"url": "https://www.insyde.com/security-pledge", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.insyde.com/security-pledge/SA-2022044", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-450613.pdf", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.insyde.com/security-pledge", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.insyde.com/security-pledge/SA-2022044", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-367"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-367"}]}], "descriptions": [{"lang": "en", "value": "Update description and links DMA transactions which are targeted at input buffers used for the software SMI handler used by the FvbServicesRuntimeDxe driver could cause SMRAM corruption through a TOCTOU attack.. \"DMA transactions which are targeted at input buffers used for the software SMI handler used by the FvbServicesRuntimeDxe driver could cause SMRAM corruption. This issue was discovered by Insyde engineering based on the general description provided by Intel's iSTARE group. Fixed in Kernel 5.2: 05.27.21. Kernel 5.3: 05.36.21. Kernel 5.4: 05.44.21. Kernel 5.5: 05.52.21 https://www.insyde.com/security-pledge/SA-2022044"}, {"lang": "es", "value": "Actualizar descripci\u00f3n y enlaces Las transacciones DMA que est\u00e1n dirigidas a los b\u00faferes de entrada utilizados para el controlador SMI de software utilizado por el controlador FvbServicesRuntimeDxe podr\u00edan causar corrupci\u00f3n de SMRAM a trav\u00e9s de un ataque TOCTOU. \"Las transacciones DMA que est\u00e1n dirigidas a los b\u00faferes de entrada utilizados para el controlador SMI de software utilizado por el controlador FvbServicesRuntimeDxe podr\u00eda causar corrupci\u00f3n de SMRAM. Este problema fue descubierto por ingenier\u00eda de Insyde bas\u00e1ndose en la descripci\u00f3n general proporcionada por el grupo iSTARE de Intel. Corregido en Kernel 5.2: 05.27.21. Kernel 5.3: 05.36.21. Kernel 5.4: 05.44.21. Kernel 5.5: 05.52.21 https://www.insyde.com/security-pledge/SA-2022044"}], "lastModified": "2025-04-30T20:15:17.320", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:insyde:kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0C087718-2996-4535-B23D-9E63E6A44289", "versionEndExcluding": "5.2.05.27.21", "versionStartIncluding": "5.2"}, {"criteria": "cpe:2.3:a:insyde:kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2879B5DC-CBDE-414A-B872-7145F39684F9", "versionEndExcluding": "5.3.05.36.21", "versionStartIncluding": "5.3"}, {"criteria": "cpe:2.3:a:insyde:kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "26A55209-8EF2-4E7A-B2C5-8254096DB418", "versionEndExcluding": "5.4.05.44.21", "versionStartIncluding": "5.4"}, {"criteria": "cpe:2.3:a:insyde:kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A4661E31-75B8-41A8-B5AD-04D22F2B1BA5", "versionEndExcluding": "5.5.05.52.21", "versionStartIncluding": "5.5"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}