CVE-2024-52877: High severity insyde insydeh2o uefi bios vulnerability
An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel 5.5 before version 05.54.50, kernel 5.6 before version 05.61.50, and kernel 5.7 before version 05.70.50. In VariableRuntimeDxe driver, callback function SmmCreateVariableLockList () calls CreateVariableLockListInSmm (). In CreateVariableLockListInSmm (), it uses StrSize () to get variable name size and it could lead to a buffer over-read.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-52877?
The severity of CVE-2024-52877 has not been disclosed in detail, but it affects multiple versions of InsydeH2O kernel.
Which versions of Insyde InsydeH2O are vulnerable to CVE-2024-52877?
CVE-2024-52877 affects InsydeH2O kernels 5.2 through 5.7, specifically versions prior to 05.29.50, 05.38.50, 05.46.50, 05.54.50, 05.61.50, and 05.70.50 respectively.
How do I fix CVE-2024-52877?
To fix CVE-2024-52877, update the InsydeH2O kernel to the latest version that mitigates the vulnerability.
What potential risks does CVE-2024-52877 pose?
CVE-2024-52877 may allow unauthorized access or control over systems running affected versions of the InsydeH2O kernel.
Is there a known exploit for CVE-2024-52877?
As of now, there are no public details regarding specific exploits for CVE-2024-52877.