QwikSec

Security Database

CVE

CWE

Training

CVE-2022-36338

Published: Sep 23, 2022

Modified: May 5, 2025

PUBLISHED

Description

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An SMM callout vulnerability in the SMM driver FwBlockServiceSmm, creating SMM, leads to arbitrary code execution. An attacker can replace the pointer to the UEFI boot service GetVariable with a pointer to malware, and then generate a software SMI.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

https://www.insyde.com/security-pledge

x_refsource_MISC

https://binarly.io/advisories/BRLY-2022-017/index.html

x_refsource_MISC

https://www.insyde.com/security-pledge/SA-2022029

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.