CVE-2022-30283
Vulnerability from cvelistv5
Published
2022-11-15 00:00
Modified
2024-08-03 06:48
Severity
Summary
In UsbCoreDxe, tampering with the contents of the USB working buffer using DMA while certain USB transactions are in process leads to a TOCTOU problem that could be used by an attacker to cause SMRAM corruption and escalation of privileges The UsbCoreDxe module creates a working buffer for USB transactions outside of SMRAM. The code which uses can be inside of SMM, making the working buffer untrusted input. The buffer can be corrupted by DMA transfers. The SMM code code attempts to sanitize pointers to ensure all pointers refer to the working buffer, but when a pointer is not found in the list of pointers to sanitize, the current action is not aborted, leading to undefined behavior. This issue was discovered by Insyde engineering based on the general description provided by Intel's iSTARE group. Fixed in: Kernel 5.0: Version 05.09. 21 Kernel 5.1: Version 05.17.21 Kernel 5.2: Version 05.27.21 Kernel 5.3: Version 05.36.21 Kernel 5.4: Version 05.44.21 Kernel 5.5: Version 05.52.21 https://www.insyde.com/security-pledge/SA-2022063
References
SourceURLTags
cve@mitre.orghttps://www.insyde.com/security-pledgeVendor Advisory
cve@mitre.orghttps://www.insyde.com/security-pledge/SA-2022063Vendor Advisory
Impacted products
VendorProduct
n/an/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T06:48:34.867Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.insyde.com/security-pledge"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.insyde.com/security-pledge/SA-2022063"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In UsbCoreDxe, tampering with the contents of the USB working buffer using DMA while certain USB transactions are in process leads to a TOCTOU problem that could be used by an attacker to cause SMRAM corruption and escalation of privileges The UsbCoreDxe module creates a working buffer for USB transactions outside of SMRAM. The code which uses can be inside of SMM, making the working buffer untrusted input. The buffer can be corrupted by DMA transfers. The SMM code code attempts to sanitize pointers to ensure all pointers refer to the working buffer, but when a pointer is not found in the list of pointers to sanitize, the current action is not aborted, leading to undefined behavior. This issue was discovered by Insyde engineering based on the general description provided by Intel\u0027s iSTARE group. Fixed in: Kernel 5.0: Version 05.09. 21 Kernel 5.1: Version 05.17.21 Kernel 5.2: Version 05.27.21 Kernel 5.3: Version 05.36.21 Kernel 5.4: Version 05.44.21 Kernel 5.5: Version 05.52.21 https://www.insyde.com/security-pledge/SA-2022063"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-11-15T00:00:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.insyde.com/security-pledge"
        },
        {
          "url": "https://www.insyde.com/security-pledge/SA-2022063"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2022-30283",
    "datePublished": "2022-11-15T00:00:00",
    "dateReserved": "2022-05-04T00:00:00",
    "dateUpdated": "2024-08-03T06:48:34.867Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-30283\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2022-11-15T21:15:36.810\",\"lastModified\":\"2022-11-23T16:33:52.647\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In UsbCoreDxe, tampering with the contents of the USB working buffer using DMA while certain USB transactions are in process leads to a TOCTOU problem that could be used by an attacker to cause SMRAM corruption and escalation of privileges The UsbCoreDxe module creates a working buffer for USB transactions outside of SMRAM. The code which uses can be inside of SMM, making the working buffer untrusted input. The buffer can be corrupted by DMA transfers. The SMM code code attempts to sanitize pointers to ensure all pointers refer to the working buffer, but when a pointer is not found in the list of pointers to sanitize, the current action is not aborted, leading to undefined behavior. This issue was discovered by Insyde engineering based on the general description provided by Intel\u0027s iSTARE group. Fixed in: Kernel 5.0: Version 05.09. 21 Kernel 5.1: Version 05.17.21 Kernel 5.2: Version 05.27.21 Kernel 5.3: Version 05.36.21 Kernel 5.4: Version 05.44.21 Kernel 5.5: Version 05.52.21 https://www.insyde.com/security-pledge/SA-2022063\"},{\"lang\":\"es\",\"value\":\"En UsbCoreDxe, la manipulaci\u00f3n del contenido del b\u00fafer de trabajo USB usando DMA mientras ciertas transacciones USB est\u00e1n en proceso conduce a un problema TOCTOU que podr\u00eda ser utilizado por un atacante para causar corrupci\u00f3n SMRAM y escalada de privilegios. El m\u00f3dulo UsbCoreDxe crea un b\u00fafer de trabajo para transacciones USB fuera de SMRAM. El c\u00f3digo que se utiliza puede estar dentro de SMM, lo que hace que el b\u00fafer de trabajo sea una entrada no confiable. El b\u00fafer puede resultar da\u00f1ado por las transferencias DMA. El c\u00f3digo SMM intenta sanitizar los punteros para garantizar que todos los punteros se refieran al b\u00fafer de trabajo, pero cuando no se encuentra un puntero en la lista de punteros para sanitizar la acci\u00f3n actual no se cancela, lo que genera un comportamiento indefinido. Este problema fue descubierto por ingenier\u00eda de Insyde bas\u00e1ndose en la descripci\u00f3n general proporcionada por el grupo iSTARE de Intel. Corregido en: Kernel 5.0: Versi\u00f3n 05.09. 21 Kernel 5.1: Versi\u00f3n 05.17.21 Kernel 5.2: Versi\u00f3n 05.27.21 Kernel 5.3: Versi\u00f3n 05.36.21 Kernel 5.4: Versi\u00f3n 05.44.21 Kernel 5.5: Versi\u00f3n 05.52.21 \\nhttps://www.insyde.com/security-pledge/SA-2022063\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":0.8,\"impactScore\":6.0}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-367\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:insyde:kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.0\",\"versionEndExcluding\":\"5.0.05.09.21\",\"matchCriteriaId\":\"8F771B7F-6A86-4EF3-9AD4-22A7A9679BDE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:insyde:kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.1\",\"versionEndExcluding\":\"5.1.05.17.21\",\"matchCriteriaId\":\"6606DD2A-0C65-4D84-B301-313850F7A631\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:insyde:kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.2\",\"versionEndExcluding\":\"5.2.05.27.21\",\"matchCriteriaId\":\"B66937EE-AE21-45AD-8FE1-2580A5CD23B1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:insyde:kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.3\",\"versionEndExcluding\":\"5.3.05.36.21\",\"matchCriteriaId\":\"23089DD9-DF12-4732-B201-D1EBDBB1D53A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:insyde:kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.4\",\"versionEndExcluding\":\"5.4.05.44.21\",\"matchCriteriaId\":\"4996E78F-CF7A-49A7-86D8-99904B50CBE2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:insyde:kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.5.05.52.21\",\"matchCriteriaId\":\"7DF5BB25-36A1-49C2-8AFB-A78E18A322ED\"}]}]}],\"references\":[{\"url\":\"https://www.insyde.com/security-pledge\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.insyde.com/security-pledge/SA-2022063\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.