CVE-2024-25078 — Untrusted Pointer Dereference in Kernel

CWE-822 — Untrusted Pointer Dereference4 documents4 sources
Severity
7.4HIGHNVD
EPSS
0.1%
top 70.37%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Insyde Kernel
Timeline
PublishedMay 15

Description

A memory corruption vulnerability in StorageSecurityCommandDxe in Insyde InsydeH2O before kernel 5.2: IB19130163 in 05.29.07, kernel 5.3: IB19130163 in 05.38.07, kernel 5.4: IB19130163 in 05.46.07, kernel 5.5: IB19130163 in 05.54.07, and kernel 5.6: IB19130163 in 05.61.07 could lead to escalating privileges in SMM.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:LExploitability: 0.8 | Impact: 6.0

Affected Packages1 packages

▶NVDinsyde/kernel5.2 — 5.29.07+4

🔴Vulnerability Details

2
GHSA
GHSA-2pww-4jgc-f998: A memory corruption vulnerability in StorageSecurityCommandDxe in Insyde InsydeH2O before kernel 5↗2024-05-15
▶
CVEList
CVE-2024-25078: A memory corruption vulnerability in StorageSecurityCommandDxe in Insyde InsydeH2O before kernel 5↗2024-05-15
▶
CVE-2024-25078 — Untrusted Pointer Dereference | cvebase