VulnerabilityModified
CVE-2023-28468
The FvbServicesRuntimeDxe SMM module exposes an SMI handler that allows an attacker to interact with the SPI flash at run-time from the OS.
MEDIUM 6.5EPSS 0.15%
Does this matter?
Lower severity and a low EPSS score (0.15%). Track it; it rarely justifies an emergency change on its own.
Description
An issue was discovered in FvbServicesRuntimeDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. The FvbServicesRuntimeDxe SMM module exposes an SMI handler that allows an attacker to interact with the SPI flash at run-time from the OS.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
- EPSS
- 0.15% probability · 5th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-863
- Affected
- insyde/kernel
- Source
- cve@mitre.org
References
- https://www.insyde.com/security-pledgeNot Applicable
- https://www.insyde.com/security-pledge/SA-2023039Vendor Advisory
- https://www.insyde.com/security-pledgeNot Applicable
- https://www.insyde.com/security-pledge/SA-2023039Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.