High severity7.8NVD Advisory· Published Apr 12, 2023· Updated Jun 17, 2026

CVE-2023-22616

Description

An issue was discovered in Insyde InsydeH2O with kernel 5.2 through 5.5. The Save State register is not checked before use. The IhisiSmm driver does not check the value of a save state register before use. Due to insufficient input validation, an attacker can corrupt SMRAM.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Insyde/InsydeH2O2 versions
cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*range: >=5.2,<=5.5
- (no CPE)range: 5.2 - 5.5
Insyde/InsydeH2Odescription

Patches

Vulnerability mechanics

References

research.nccgroup.com/2023/04/11/stepping-insyde-system-management-mode/nvdExploitThird Party Advisory
www.insyde.com/security-pledgenvdVendor Advisory
www.insyde.com/security-pledge/SA-2023022nvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.507
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000