CVE-2022-32955

HighCVSS 7.0/10Last modified Jun 17, 2026

Description

An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the NvmExpressDxe buffer used by SMM and non-SMM code could cause TOCTOU race-condition issues that could lead to corruption of SMRAM and escalation of privileges. This attack can be mitigated by using IOMMU protection for the ACPI runtime memory used for the command buffer. This attack can be mitigated by copying the link data to SMRAM before checking it and verifying that all pointers are within the buffer.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-367

Affected software

No affected versions have been published.

Timeline

Published: Feb 15, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-329586.5A remote attacker with general user privilege can send a message to Teamplus Pro’s chat group that exceeds message size limit, to terminate CVE-2022-329596.8HiCOS’ client-side citizen digital certificate component has a stack-based buffer overflow vulnerability when reading IC card due to insuffi CVE-2022-32967.8Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0577.CVE-2022-329606.8HiCOS’ client-side citizen digital certificate component has a stack-based buffer overflow vulnerability when reading IC card due to insuffi CVE-2022-329616.8HICOS’ client-side citizen digital certificate component has a stack-based buffer overflow vulnerability when reading IC card due to insuffi CVE-2022-329626.8HiCOS’ client-side citizen certificate component has a double free vulnerability. An unauthenticated physical attacker can exploit this vuln CVE-2022-329637.5OMICARD EDM’s mail file relay function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability CVE-2022-329649.8OMICARD EDM’s API function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL commands CVE-2022-329659.8OMICARD EDM has a hard-coded machine key. An unauthenticated remote attacker can use the machine key to send serialized payload to the serve CVE-2022-329666.5RTL8168FP-CG Dash remote management function has missing authorization. An unauthenticated attacker within the adjacent network can connect CVE-2022-329672.1RTL8111EP-CG/RTL8111FP-CG DASH function has hard-coded password. An unauthenticated physical attacker can use the hard-coded default passwor CVE-2022-329695.9MetaMask before 10.11.3 might allow an attacker to access a user's secret recovery phrase because an input field is used for a BIP39 mnemoni