CVE Feed

    Dashboard / CVE / CVE-2022-30772

    CVE-2022-30772

    Manipulation of the input address in PnpSmm function 0x52 could be used by malware to overwrite SMRAM or OS kernel memory. Function 0x52 of the PnpSmm driver is passed the address and size of data to write into the SMBIOS table, but manipulation of the address could be used by malware to overwrite SMRAM or OS kernel memory. This issue was discovered by Insyde engineering during a security review. This issue is fixed in: Kernel 5.0: 05.09.41 Kernel 5.1: 05.17.43 Kernel 5.2: 05.27.30 Kernel 5.3: 05.36.30 Kernel 5.4: 05.44.30 Kernel 5.5: 05.52.30 https://www.insyde.com/security-pledge/SA-2022065

    Published:Nov 15, 2022
    Last Modified:Apr 30, 2025
    EPS:Nov 15, 2022
    EPSS Score:0.00052
    CVSS Score:8.2

    Affected Products

    Vendor
    Insyde
    Product
    Kernel

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-787 Out-of-bounds Write

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2024-52880 (CVSS 7.9) — An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.3…
    CVE-2024-49200 (CVSS 6.4) — An issue was discovered in AcpiS3SaveDxe and ChipsetSvcDxe in Insyde InsydeH2O with kernel 5.2 though 5.7. A p…
    CVE-2024-25078 (CVSS 7.4) — A memory corruption vulnerability in StorageSecurityCommandDxe in Insyde InsydeH2O before kernel 5.2: IB191301…
    CVE-2023-47252 (CVSS 6.3) — An issue was discovered in PnpSmm in Insyde InsydeH2O with kernel 5.0 through 5.6. There is a possible out-of-…
    CVE-2022-46897 (CVSS 5.3) — An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. The CapsuleIFWUSmm driver does not ch…
    CVE-2023-28468 (CVSS 6.5) — An issue was discovered in FvbServicesRuntimeDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. The FvbServi…
    CVE-2022-36337 (CVSS 8.2) — An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. A stack buffer overflow vulnerability…
    CVE-2022-35407 (CVSS 7.8) — An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. A stack buffer overflow leads to arbi…
    CVE-2022-35897 (CVSS 6.8) — An stack buffer overflow vulnerability leads to arbitrary code execution issue was discovered in Insyde Insyde…
    CVE-2022-30771 (CVSS 8.2) — Initialization function in PnpSmm could lead to SMRAM corruption when using subsequent PNP SMI functions Initi…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High