An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel 5.5 before version 05.54.50, kernel 5.6 before version 05.61.50, and kernel 5.7 before version 05.70.50. In VariableRuntimeDxe driver, VariableServicesSetVariable () can be called by gRT_>SetVariable () or the SmmSetSensitiveVariable () or SmmInternalSetVariable () from SMM. In VariableServicesSetVariable (), it uses StrSize () to get variable name size, uses StrLen () to get variable name length and uses StrCmp () to compare strings. These actions may cause a buffer over-read.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://www.insyde.com/security-pledge | Vendor Advisory |
| https://www.insyde.com/security-pledge/sa-2024016/ | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
15 Aug 2025, 17:05
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.insyde.com/security-pledge - Vendor Advisory | |
| References | () https://www.insyde.com/security-pledge/sa-2024016/ - Vendor Advisory | |
| CPE | cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:* | |
| First Time |
Insyde insydeh2o
Insyde |
15 May 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-05-15 16:15
Updated : 2025-08-15 17:05
NVD link : CVE-2024-52878
Mitre link : CVE-2024-52878
JSON object : View
Products Affected
insyde
- insydeh2o
CWE
No CWE.