CVE-2022-30771
Last modified
CVE-2022-30771 is a high-severity vulnerability rated 8.2/10 on the CVSS scale. Initialization function in PnpSmm could lead to SMRAM corruption when using subsequent PNP SMI functions Initialization function in PnpSmm could lead to SMRAM corruption when using subsequent PNP SMI functions. This issue was discovered by Insyde engineering during a security review. EPSS estimates a 0.19% chance of exploitation in the next 30 days.
Description
Initialization function in PnpSmm could lead to SMRAM corruption when using subsequent PNP SMI functions Initialization function in PnpSmm could lead to SMRAM corruption when using subsequent PNP SMI functions. This issue was discovered by Insyde engineering during a security review. Fixed in: Kernel 5.1: Version 05.17.25 Kernel 5.2: Version 05.27.25 Kernel 5.3: Version 05.36.25 Kernel 5.4: Version 05.44.25 Kernel 5.5: Version 05.52.25 https://www.insyde.com/security-pledge/SA-2022064
Metrics
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Insyde | Kernel | >= 5.1, < 5.1.05.17.25 |
| Insyde | Kernel | >= 5.2, < 5.2.05.27.25 |
| Insyde | Kernel | >= 5.3, < 5.3.05.36.25 |
| Insyde | Kernel | >= 5.4, < 5.4.05.44.25 |
| Insyde | Kernel | >= 5.5, < 5.5.05.52.25 |
References
- https://www.insyde.com/security-pledgeVendor Advisory
- https://www.insyde.com/security-pledge/SA-2022064Vendor Advisory
- https://www.insyde.com/security-pledgeVendor Advisory
- https://www.insyde.com/security-pledge/SA-2022064Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-30771?
How severe is CVE-2022-30771?
How do I fix CVE-2022-30771?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-30765Calibre-Web before 0.6.18 allows user table SQL Injection.9.8
- CVE-2022-30767nfs_lookup_reply in net/nfs.c in Das U-Boot through 2022.04 …9.8
- CVE-2022-30768A Stored Cross Site Scripting (XSS) issue in ZoneMinder 1.36…5.4
- CVE-2022-30769Session fixation exists in ZoneMinder through 1.36.12 as an …4.6
- CVE-2022-3077A buffer overflow vulnerability was found in the Linux kerne…5.5
- CVE-2022-30770Terminalfour versions 8.3.7, 8.3.x versions prior to version…6.1
- CVE-2022-30772Manipulation of the input address in PnpSmm function 0x52 co…8.2
- CVE-2022-30773DMA attacks on the parameter buffer used by the IhisiSmm dri…6.4
- CVE-2022-30774DMA attacks on the parameter buffer used by the PnpSmm drive…6.4
- CVE-2022-30775xpdf 4.04 allocates excessive memory when presented with cra…5.5
- CVE-2022-30776atmail 6.5.0 allows XSS via the index.php/admin/index/ error…6.1
- CVE-2022-30777Parallels H-Sphere 3.6.1713 allows XSS via the index_en.php …6.1
Are you affected by CVE-2022-30771?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST