VYPR
← All advisories
High severity8.2NVD Advisory· Published Sep 23, 2022· Updated Jun 17, 2026

CVE-2022-36338

CVE-2022-36338

Description

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An SMM callout vulnerability in the SMM driver FwBlockServiceSmm, creating SMM, leads to arbitrary code execution. An attacker can replace the pointer to the UEFI boot service GetVariable with a pointer to malware, and then generate a software SMI.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Insyde/InsydeH2O2 versions
    cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*range: >=5.0,<=5.5
    • (no CPE)range: 5.0-5.5
  • Insyde/InsydeH2Odescription

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.