An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel 5.5 before version 05.54.50, kernel 5.6 before version 05.61.50, and kernel 5.7 before version 05.70.50. In VariableRuntimeDxe driver, SmmUpdateVariablePropertySmi () is a SMM callback function and it uses StrCmp () to compare variable names. This action may cause a buffer over-read.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://www.insyde.com/security-pledge | Vendor Advisory |
| https://www.insyde.com/security-pledge/sa-2024016/ | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
15 Aug 2025, 17:04
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Insyde insydeh2o
Insyde |
|
| CPE | cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:* | |
| References | () https://www.insyde.com/security-pledge - Vendor Advisory | |
| References | () https://www.insyde.com/security-pledge/sa-2024016/ - Vendor Advisory |
15 May 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-05-15 16:15
Updated : 2025-08-15 17:04
NVD link : CVE-2024-52879
Mitre link : CVE-2024-52879
JSON object : View
Products Affected
insyde
- insydeh2o
CWE
No CWE.