CVE-2023-28468

Published: Aug 3, 2023Modified: Nov 21, 2024

6.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Exploitability: 2.0 / Impact: 4.0

Source: NVD

Description

An issue was discovered in FvbServicesRuntimeDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. The FvbServicesRuntimeDxe SMM module exposes an SMI handler that allows an attacker to interact with the SPI flash at run-time from the OS.

Affected (1)

Products: Insyde: Kernel

Insyde

1 product

Kernel

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Insyde Kernel	From 5.0 to 5.5

Related CWEs

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (4)

https://www.insyde.com/security-pledge

Source: cve@mitre.org

Not Applicable

https://www.insyde.com/security-pledge/SA-2023039

Source: cve@mitre.org

Vendor Advisory

https://www.insyde.com/security-pledge

Source: af854a3a-2127-422b-91ae-364da2661108

Not Applicable

https://www.insyde.com/security-pledge/SA-2023039

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.