CVE-2022-30283

In UsbCoreDxe, tampering with the contents of the USB working buffer using DMA while certain USB transactions are in process leads to a TOCTOU problem that could be used by an attacker to cause SMRAM corruption and escalation of privileges The UsbCoreDxe module creates a working buffer for USB transactions outside of SMRAM. The code which uses can be inside of SMM, making the working buffer untrusted input. The buffer can be corrupted by DMA transfers. The SMM code code attempts to sanitize pointers to ensure all pointers refer to the working buffer, but when a pointer is not found in the list of pointers to sanitize, the current action is not aborted, leading to undefined behavior. This issue was discovered by Insyde engineering based on the general description provided by Intel's iSTARE group. Fixed in: Kernel 5.0: Version 05.09. 21 Kernel 5.1: Version 05.17.21 Kernel 5.2: Version 05.27.21 Kernel 5.3: Version 05.36.21 Kernel 5.4: Version 05.44.21 Kernel 5.5: Version 05.52.21 https://www.insyde.com/security-pledge/SA-2022063

• CWE-367
• CWE-367

• https://www.insyde.com/security-pledgeVendor Advisory
• https://www.insyde.com/security-pledge/SA-2022063Vendor Advisory
• https://www.insyde.com/security-pledgeVendor Advisory
• https://www.insyde.com/security-pledge/SA-2022063Vendor Advisory

Published

Nov 15, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-30276The Motorola MOSCAD and ACE line of RTUs through 2022-05-02 …7.5
• CVE-2022-30277BD Synapsys™, versions 4.20, 4.20 SR1, and 4.30, contain an …5.7
• CVE-2022-30278A vulnerability in Black Duck Hub’s embedded MadCap Flare do…6.1
• CVE-2022-30279An issue was discovered in Stormshield Network Security (SNS…7.5
• CVE-2022-3028A race condition was found in the Linux kernel's IP framewor…7
• CVE-2022-30280/SecurityManagement/html/createuser.jsf in Nokia NetAct 22 a…8.8
• CVE-2022-30284In the python-libnmap package through 0.7.2 for Python, remo…9.8
• CVE-2022-30285In Quest KACE Systems Management Appliance (SMA) through 12.…9.8
• CVE-2022-30286pyscriptjs (aka PyScript Demonstrator) in PyScript through 2…7.5
• CVE-2022-30287Horde Groupware Webmail Edition through 5.2.22 allows a refl…8
• CVE-2022-30288Agoo before 2.14.3 does not reject GraphQL fragment spreads …7.5
• CVE-2022-30289A stored Cross-site Scripting (XSS) vulnerability was identi…5.4