CVE-2022-33983Time-of-check Time-of-use (TOCTOU) Race Condition in Kernel

Severity
7.0HIGHNVD
EPSS
0.0%
top 88.66%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedNov 15

Description

DMA transactions which are targeted at input buffers used for the NvmExpressLegacy software SMI handler could cause SMRAM corruption through a TOCTOU attack. DMA transactions which are targeted at input buffers used for the software SMI handler used by the NvmExpressLegacy driver could cause SMRAM corruption through a TOCTOU attack. This issue was discovered by Insyde engineering based on the general description provided by Intel's iSTARE group. This issue was fixed in kernel 5.2: 05.27.25, kern

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.0 | Impact: 5.9

Affected Packages1 packages

NVDinsyde/kernel5.25.2.05.27.25+3

🔴Vulnerability Details

2
GHSA
GHSA-h268-hqv8-wgw2: DMA transactions which are targeted at input buffers used for the NvmExpressLegacy software SMI handler could cause SMRAM corruption through a TOCTOU2022-11-15
CVEList
CVE-2022-33983: DMA transactions which are targeted at input buffers used for the NvmExpressLegacy software SMI handler could cause SMRAM corruption through a TOCTOU2022-11-14
CVE-2022-33983 — Insyde Kernel vulnerability | cvebase