CVE-2022-33982
Last modified
CVE-2022-33982 is a medium-severity vulnerability rated 6.4/10 on the CVSS scale. DMA attacks on the parameter buffer used by the Int15ServiceSmm software SMI handler could lead to a TOCTOU attack on the SMI handler and lead to corruption of SMRAM. DMA attacks on the parameter buffer used by the software SMI handler used by the driver Int15ServiceSmm could lead to a TOCTOU attack on the SMI handler and lead to corruption of SMRAM. EPSS estimates a 0.15% chance of exploitation in the next 30 days.
Description
DMA attacks on the parameter buffer used by the Int15ServiceSmm software SMI handler could lead to a TOCTOU attack on the SMI handler and lead to corruption of SMRAM. DMA attacks on the parameter buffer used by the software SMI handler used by the driver Int15ServiceSmm could lead to a TOCTOU attack on the SMI handler and lead to corruption of SMRAM. This issue was discovered by Insyde engineering during a security review. This issue is fixed in Kernel 5.2: 05.27.23, Kernel 5.3: 05.36.23, Kernel 5.4: 05.44.23 and Kernel 5.5: 05.52.23 CWE-367
Metrics
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Insyde | Kernel | >= 5.2, < 5.2.05.27.23 |
| Insyde | Kernel | >= 5.3, < 5.3.05.36.23 |
| Insyde | Kernel | >= 5.4, < 5.4.05.44.23 |
| Insyde | Kernel | >= 5.5, < 5.5.05.52.23 |
References
- https://www.insyde.com/security-pledgeVendor Advisory
- https://www.insyde.com/security-pledge/SA-2022052Vendor Advisory
- https://www.insyde.com/security-pledgeVendor Advisory
- https://www.insyde.com/security-pledge/SA-2022052Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-33982?
How severe is CVE-2022-33982?
How do I fix CVE-2022-33982?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-33977untangle is a python library to convert XML data to python o…7.5
- CVE-2022-33978Reflected Cross-Site Scripting (XSS) vulnerability FontMeist…6.1
- CVE-2022-33979Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2022-3398OMRON CX-Programmer 9.78 and prior is vulnerable to an Out-o…9.8
- CVE-2022-33980Apache Commons Configuration performs variable interpolation…9.8
- CVE-2022-33981drivers/block/floppy.c in the Linux kernel before 5.17.6 is …3.3
- CVE-2022-33983DMA transactions which are targeted at input buffers used fo…7
- CVE-2022-33984DMA transactions which are targeted at input buffers used fo…7
- CVE-2022-33985DMA transactions which are targeted at input buffers used fo…7
- CVE-2022-33986DMA attacks on the parameter buffer used by the VariableRunt…6.4
- CVE-2022-33987The got package before 12.1.0 (also fixed in 11.8.5) for Nod…5.3
- CVE-2022-33988dproxy-nexgen (aka dproxy nexgen) re-uses the DNS transactio…7.5
Are you affected by CVE-2022-33982?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST