CVE-2024-52880: Input Validation
An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel 5.5 before version 05.54.50, kernel 5.6 before version 05.61.50, and kernel 5.7 before version 05.70.50. In VariableRuntimeDxe driver, SecureBootHandler uses DataSize and VariableNameSize when determining if the data or name are in the buffer, but these are supplied by the caller and therefore cannot be trusted.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-52880?
CVE-2024-52880 has a high severity rating due to its potential impact on system integrity and security.
How do I fix CVE-2024-52880?
To fix CVE-2024-52880, update your Insyde InsydeH2O kernel to a version later than the affected versions listed.
Which versions are affected by CVE-2024-52880?
CVE-2024-52880 affects InsydeH2O kernel versions 5.2 up to 05.29.50, 5.3 up to 05.38.50, 5.4 up to 05.46.50, 5.5 up to 05.54.50, 5.6 up to 05.61.50, and 5.7 up to 05.70.50.
What type of vulnerability is CVE-2024-52880?
CVE-2024-52880 is a security vulnerability in the VariableRuntimeDxe driver of the InsydeH2O kernel.
Who is affected by CVE-2024-52880?
Organizations using any affected versions of InsydeH2O kernel are at risk due to CVE-2024-52880.