CVE-2022-30773
Last modified
CVE-2022-30773 is a medium-severity vulnerability rated 6.4/10 on the CVSS scale. DMA attacks on the parameter buffer used by the IhisiSmm driver could change the contents after parameter values have been checked but before they are used (a TOCTOU attack). DMA attacks on the parameter buffer used by the IhisiSmm driver could change the contents after parameter values have been checked but before they are used (a TOCTOU attack). EPSS estimates a 0.13% chance of exploitation in the next 30 days.
Description
DMA attacks on the parameter buffer used by the IhisiSmm driver could change the contents after parameter values have been checked but before they are used (a TOCTOU attack). DMA attacks on the parameter buffer used by the IhisiSmm driver could change the contents after parameter values have been checked but before they are used (a TOCTOU attack). This issue was discovered by Insyde engineering. This issue is fixed in Kernel 5.4: 05.44.23 and Kernel 5.5: 05.52.23. CWE-367
Metrics
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Insyde | Kernel | >= 5.4, < 5.4.05.44.23 |
| Insyde | Kernel | >= 5.5, < 5.5.05.52.23 |
References
- https://www.insyde.com/security-pledgeVendor Advisory
- https://www.insyde.com/security-pledge/SA-2022042Vendor Advisory
- https://www.insyde.com/security-pledgeVendor Advisory
- https://www.insyde.com/security-pledge/SA-2022042Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-30773?
How severe is CVE-2022-30773?
How do I fix CVE-2022-30773?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-30768A Stored Cross Site Scripting (XSS) issue in ZoneMinder 1.36…5.4
- CVE-2022-30769Session fixation exists in ZoneMinder through 1.36.12 as an …4.6
- CVE-2022-3077A buffer overflow vulnerability was found in the Linux kerne…5.5
- CVE-2022-30770Terminalfour versions 8.3.7, 8.3.x versions prior to version…6.1
- CVE-2022-30771Initialization function in PnpSmm could lead to SMRAM corrup…8.2
- CVE-2022-30772Manipulation of the input address in PnpSmm function 0x52 co…8.2
- CVE-2022-30774DMA attacks on the parameter buffer used by the PnpSmm drive…6.4
- CVE-2022-30775xpdf 4.04 allocates excessive memory when presented with cra…5.5
- CVE-2022-30776atmail 6.5.0 allows XSS via the index.php/admin/index/ error…6.1
- CVE-2022-30777Parallels H-Sphere 3.6.1713 allows XSS via the index_en.php …6.1
- CVE-2022-30778Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2022-30779Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
Are you affected by CVE-2022-30773?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST