CVE-2022-31243

MEDIUM Year: 2022
CVSS v3 Score
6.4
Medium
Weakness Type
CWE-367
View all →

Vulnerability Description

Update description and links DMA transactions which are targeted at input buffers used for the software SMI handler used by the FvbServicesRuntimeDxe driver could cause SMRAM corruption through a TOCTOU attack.. "DMA transactions which are targeted at input buffers used for the software SMI handler used by the FvbServicesRuntimeDxe driver could cause SMRAM corruption. This issue was discovered by Insyde engineering based on the general description provided by Intel's iSTARE group. Fixed in Kernel 5.2: 05.27.21. Kernel 5.3: 05.36.21. Kernel 5.4: 05.44.21. Kernel 5.5: 05.52.21 https://www.insyde.com/security-pledge/SA-2022044

Related Vulnerabilities

CVE-2020-0358

MEDIUM
CVSS:6.4(Medium)

In SurfaceFlinger, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed ...

CWE-3672020

CVE-2020-11220

MEDIUM
CVSS:6.4(Medium)

While processing storage SCM commands there is a time of check or time of use window where a pointer used could be invalid at a specific time while executing the storage SCM call in Snapdragon Auto, S...

CWE-3672020

CVE-2020-11230

MEDIUM
CVSS:6.4(Medium)

Potential arbitrary memory corruption when the qseecom driver updates ion physical addresses in the buffer as it exposes a physical address to user land in Snapdragon Auto, Snapdragon Compute, Snapdra...

CWE-3672020

CVE-2020-12926

MEDIUM
CVSS:6.4(Medium)

The Trusted Platform Modules (TPM) reference software may not properly track the number of times a failed shutdown happens. This can leave the TPM in a state where confidential key material in the TPM...

CWE-3672020

CVE-2020-27014

MEDIUM
CVSS:6.4(Medium)

Trend Micro Antivirus for Mac 2020 (Consumer) contains a race condition vulnerability in the Web Threat Protection Blocklist component, that if exploited, could allow an attacker to case a kernel pani...

CWE-3672020

CVE-2020-8332

MEDIUM
CVSS:6.4(Medium)

A potential vulnerability in the SMI callback function used in the legacy BIOS mode USB drivers in some legacy Lenovo and IBM System x servers may allow arbitrary code execution. Servers operating in ...

CWE-3672020