CVE-2022-24069

HighCVSS 8.2/10Last modified Aug 11, 2026

Description

An issue was discovered in AhciBusDxe in Insyde InsydeH2O with kernel 5.0 before 05.08.41, 5.1 before 05.16.29, 5.2 before 05.26.29, 5.3 before 05.35.29, 5.4 before 05.43.29, and 5.5 before 05.51.29. An SMM callout vulnerability allows an attacker to hijack the execution flow of code running in System Management Mode. Exploiting this issue could lead to escalating privileges to SMM.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: Feb 3, 2022
Last modified: Aug 11, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-24074.8The WP phpMyAdmin WordPress plugin before 5.2.0.4 does not escape some of its settings, which could allow high privilege users such as admin CVE-2022-240707.5Subversion's mod_dav_svn is vulnerable to memory corruption. While looking up path-based authorization rules, mod_dav_svn servers may attemp CVE-2022-240714.3A Built-in extension in Whale browser before 3.12.129.46 allows attackers to compromise the rendering process which could lead to controllin CVE-2022-240726.1The devtools API in Whale browser before 3.12.129.18 allowed extension developers to inject arbitrary JavaScript into the extension store we CVE-2022-240737.1The Web Request API in Whale browser before 3.12.129.18 allowed to deny access to the extension store or redirect to any URL when users acce CVE-2022-240749.8Whale Bridge, a default extension in Whale browser before 3.12.129.18, allowed to receive any SendMessage request from the content script it CVE-2022-240756.5Whale browser before 3.12.129.18 allowed extensions to replace JavaScript files of the HWP viewer website which could access to local HWP fi CVE-2022-240777.8Naver Cloud Explorer Beta allows the attacker to execute arbitrary code as System privilege via malicious DLL injection.CVE-2022-24084.3The Guest account feature in Mattermost version 6.7.0 and earlier fails to properly restrict the permissions, which allows a guest user to f CVE-2022-240829.8If an on-premise installation of the Pega Platform is configured with the port for the JMX interface exposed to the Internet and port filter CVE-2022-240839.8Password authentication bypass vulnerability for local accounts can be used to bypass local authentication checks.CVE-2022-240869.8Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during