CVE-2024-52878: High severity insyde insydeh2o uefi bios vulnerability
An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel 5.5 before version 05.54.50, kernel 5.6 before version 05.61.50, and kernel 5.7 before version 05.70.50. In VariableRuntimeDxe driver, VariableServicesSetVariable () can be called by gRT>SetVariable () or the SmmSetSensitiveVariable () or SmmInternalSetVariable () from SMM. In VariableServicesSetVariable (), it uses StrSize () to get variable name size, uses StrLen () to get variable name length and uses StrCmp () to compare strings. These actions may cause a buffer over-read.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-52878?
CVE-2024-52878 is a high-severity vulnerability affecting multiple versions of the InsydeH2O kernel.
How do I fix CVE-2024-52878?
To mitigate CVE-2024-52878, update to a patched version of InsydeH2O kernel, specifically versions after 05.29.50 for 5.2, 05.38.50 for 5.3, 05.46.50 for 5.4, 05.54.50 for 5.5, 05.61.50 for 5.6, and 05.70.50 for 5.7.
What components are affected by CVE-2024-52878?
CVE-2024-52878 affects the VariableRuntimeDxe driver in specific versions of the InsydeH2O kernel.
Which specific kernel versions are vulnerable to CVE-2024-52878?
The vulnerable kernels are 5.2 versions before 05.29.50, 5.3 before 05.38.50, 5.4 before 05.46.50, 5.5 before 05.54.50, 5.6 before 05.61.50, and 5.7 before 05.70.50.
Is there a known exploit for CVE-2024-52878?
As of now, there are no publicly disclosed exploits for CVE-2024-52878, but it is recommended to update to prevent potential risks.