CVE-2022-28806

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered on certain Fujitsu LIEFBOOK devices (A3510, U9310, U7511/U7411/U7311, U9311, E5510/E5410, U7510/U7410/U7310, E459/E449) with BIOS versions before v1.09 (A3510), v2.17 (U9310), v2.30 (U7511/U7411/U7311), v2.33 (U9311), v2.23 (E5510), v2.19 (U7510/U7410), v2.13 (U7310), and v1.09 (E459/E449). The FjGabiFlashCoreAbstractionSmm driver registers a Software System Management Interrupt (SWSMI) handler that is not sufficiently validated to ensure that the CommBuffer (or any other communication buffer's nested contents) are not pointing to SMRAM contents. A potential attacker can therefore write fixed data to SMRAM, which could lead to data corruption inside this memory (e.g., change the SMI handler's code or modify SMRAM map structures to break input pointer validation for other SMI handlers). Thus, the attacker could elevate privileges from ring 0 to ring -2 and execute arbitrary code in SMM."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-05-04T14:10:18.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.binarly.io/advisories"}, {"tags": ["x_refsource_MISC"], "url": "https://kb.cert.org/vuls/id/796611"}, {"tags": ["x_refsource_MISC"], "url": "https://support.ts.fujitsu.com/ProductSecurity/content/Fujitsu-PSIRT-FCCL-IS-2021-090903-Security-Advisory.asp"}, {"tags": ["x_refsource_MISC"], "url": "http://www.fmworld.net/biz/common/insyde/20220210/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2022-28806", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "An issue was discovered on certain Fujitsu LIEFBOOK devices (A3510, U9310, U7511/U7411/U7311, U9311, E5510/E5410, U7510/U7410/U7310, E459/E449) with BIOS versions before v1.09 (A3510), v2.17 (U9310), v2.30 (U7511/U7411/U7311), v2.33 (U9311), v2.23 (E5510), v2.19 (U7510/U7410), v2.13 (U7310), and v1.09 (E459/E449). The FjGabiFlashCoreAbstractionSmm driver registers a Software System Management Interrupt (SWSMI) handler that is not sufficiently validated to ensure that the CommBuffer (or any other communication buffer's nested contents) are not pointing to SMRAM contents. A potential attacker can therefore write fixed data to SMRAM, which could lead to data corruption inside this memory (e.g., change the SMI handler's code or modify SMRAM map structures to break input pointer validation for other SMI handlers). Thus, the attacker could elevate privileges from ring 0 to ring -2 and execute arbitrary code in SMM."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://www.binarly.io/advisories", "refsource": "MISC", "url": "https://www.binarly.io/advisories"}, {"name": "https://kb.cert.org/vuls/id/796611", "refsource": "MISC", "url": "https://kb.cert.org/vuls/id/796611"}, {"name": "https://support.ts.fujitsu.com/ProductSecurity/content/Fujitsu-PSIRT-FCCL-IS-2021-090903-Security-Advisory.asp", "refsource": "MISC", "url": "https://support.ts.fujitsu.com/ProductSecurity/content/Fujitsu-PSIRT-FCCL-IS-2021-090903-Security-Advisory.asp"}, {"name": "http://www.fmworld.net/biz/common/insyde/20220210/", "refsource": "MISC", "url": "http://www.fmworld.net/biz/common/insyde/20220210/"}]}}}, "adp": [{"title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.binarly.io/advisories"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://kb.cert.org/vuls/id/796611"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://support.ts.fujitsu.com/ProductSecurity/content/Fujitsu-PSIRT-FCCL-IS-2021-090903-Security-Advisory.asp"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.fmworld.net/biz/common/insyde/20220210/"}, {"url": "https://www.kb.cert.org/vuls/id/796611"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-04T19:13:03.588Z"}}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2022-28806", "datePublished": "2022-05-04T14:10:18.000Z", "dateReserved": "2022-04-08T00:00:00.000Z", "dateUpdated": "2025-11-04T19:13:03.588Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.2"}

{}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fujitsu:lifebook_a3510_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "7D096965-BEEB-4765-936A-76C0205F7A87", "versionEndExcluding": "1.09", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:fujitsu:lifebook_a3510:-:*:*:*:*:*:*:*", "matchCriteriaId": "E350519E-9115-4D02-9A3F-279E44DCADB1", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fujitsu:lifebook_u9310_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "5D3C820F-9E6B-44EF-B58F-4C536E890850", "versionEndExcluding": "2.17", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:fujitsu:lifebook_u9310:-:*:*:*:*:*:*:*", "matchCriteriaId": "D35E7F86-B70C-4302-AA7A-515AAAB86CE6", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fujitsu:lifebook_u7511_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "EC993E4D-97AC-41FD-818B-B8832DD7C4E7", "versionEndExcluding": "2.30", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:fujitsu:lifebook_u7511:-:*:*:*:*:*:*:*", "matchCriteriaId": "2159F29A-0476-4FA7-A07F-9CE3AE33E47D", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fujitsu:lifebook_u7411_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "99274445-0E1E-4A58-9528-F636946B648F", "versionEndExcluding": "2.30", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:fujitsu:lifebook_u7411:-:*:*:*:*:*:*:*", "matchCriteriaId": "2A32407A-912C-4784-954F-A85F73110212", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fujitsu:lifebook_u7311_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "897A232F-8958-41A6-917D-02F901540289", "versionEndExcluding": "2.30", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:fujitsu:lifebook_u7311:-:*:*:*:*:*:*:*", "matchCriteriaId": "9584201E-5DE4-4681-90A6-589F5EE117D3", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fujitsu:lifebook_u9311_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "0EDC0F4E-9A7C-4F2B-A34B-603EF460CC70", "versionEndIncluding": "2.33", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:fujitsu:lifebook_u9311:-:*:*:*:*:*:*:*", "matchCriteriaId": "BA8985F9-8E4E-42DE-A9A1-CAEEAC4B17BD", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fujitsu:lifebook_e5510_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "D27DBACF-7E52-46D1-94A2-FD5041310888", "versionEndExcluding": "2.23", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:fujitsu:lifebook_e5510:-:*:*:*:*:*:*:*", "matchCriteriaId": "FDE4F1F0-2223-4CFB-9219-20B63CF9BE1D", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fujitsu:lifebook_u7510_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "41388C68-4EB9-4E5E-8F61-F4826609C6BB", "versionEndExcluding": "2.19", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:fujitsu:lifebook_u7510:-:*:*:*:*:*:*:*", "matchCriteriaId": "1A584B2A-F13D-4A11-A7C1-4497C8239F73", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fujitsu:lifebook_u7410_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "605C3126-9A9F-446E-88C6-BCD21B0A1247", "versionEndExcluding": "2.19", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:fujitsu:lifebook_u7410:-:*:*:*:*:*:*:*", "matchCriteriaId": "97EFBF8D-46E1-4E35-A391-862993FF1345", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fujitsu:lifebook_u7310_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "E4AB1A5A-E22F-4912-8479-89384E204AE0", "versionEndExcluding": "2.13", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:fujitsu:lifebook_u7310:-:*:*:*:*:*:*:*", "matchCriteriaId": "71967660-6F2B-4BAA-9206-F19679C060FD", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fujitsu:lifebook_e459_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "21DEA6EC-7312-41DA-8B8F-06DF92318183", "versionEndExcluding": "1.09", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:fujitsu:lifebook_e459:-:*:*:*:*:*:*:*", "matchCriteriaId": "EB67EF37-09DF-44F7-A59D-C6EA8BAA1DDB", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fujitsu:lifebook_e449_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "49CF53D0-A2F0-4FFC-AB1F-A8DCE0DA367A", "versionEndExcluding": "1.09", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:fujitsu:lifebook_e449:-:*:*:*:*:*:*:*", "matchCriteriaId": "6AA9D37D-FFE8-42FE-A574-F183B72DD10F", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An issue was discovered on certain Fujitsu LIEFBOOK devices (A3510, U9310, U7511/U7411/U7311, U9311, E5510/E5410, U7510/U7410/U7310, E459/E449) with BIOS versions before v1.09 (A3510), v2.17 (U9310), v2.30 (U7511/U7411/U7311), v2.33 (U9311), v2.23 (E5510), v2.19 (U7510/U7410), v2.13 (U7310), and v1.09 (E459/E449). The FjGabiFlashCoreAbstractionSmm driver registers a Software System Management Interrupt (SWSMI) handler that is not sufficiently validated to ensure that the CommBuffer (or any other communication buffer's nested contents) are not pointing to SMRAM contents. A potential attacker can therefore write fixed data to SMRAM, which could lead to data corruption inside this memory (e.g., change the SMI handler's code or modify SMRAM map structures to break input pointer validation for other SMI handlers). Thus, the attacker could elevate privileges from ring 0 to ring -2 and execute arbitrary code in SMM."}, {"lang": "es", "value": "Se ha detectado un problema en determinados dispositivos Fujitsu LIEFBOOK (A3510, U9310, U7511/U7411/U7311, U9311, E5510/E5410, U7510/U7410/U7310, E459/E449) con versiones de BIOS anteriores a v1. 09 (A3510), v2.17 (U9310), v2.30 (U7511/U7411/U7311), v2.33 (U9311), v2.23 (E5510), v2.19 (U7510/U7410), v2.13 (U7310) y v1.09 (E459/E449). El controlador FjGabiFlashCoreAbstractionSmm registra un administrador de interrupciones del sistema de software (SWSMI) que no est\u00e1 suficientemente comprobado para garantizar que el CommBuffer (o cualquier otro contenido anidado del b\u00fafer de comunicaci\u00f3n) no apunte al contenido de la SMRAM. Por lo tanto, un atacante potencial puede escribir datos fijos en la SMRAM, lo que podr\u00eda conllevar a una corrupci\u00f3n de datos dentro de esta memoria (por ejemplo, cambiar el c\u00f3digo del manejador SMI o modificar las estructuras del mapa de la SMRAM para romper la comprobaci\u00f3n del puntero de entrada para otros manejadores SMI). As\u00ed, el atacante podr\u00eda elevar los privilegios del anillo 0 al anillo -2 y ejecutar c\u00f3digo arbitrario en SMM"}], "id": "CVE-2022-28806", "lastModified": "2026-06-17T04:39:06.370", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-05-04T15:15:13.083", "references": [{"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://www.fmworld.net/biz/common/insyde/20220210/"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://kb.cert.org/vuls/id/796611"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://support.ts.fujitsu.com/ProductSecurity/content/Fujitsu-PSIRT-FCCL-IS-2021-090903-Security-Advisory.asp"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.binarly.io/advisories"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://www.fmworld.net/biz/common/insyde/20220210/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://kb.cert.org/vuls/id/796611"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://support.ts.fujitsu.com/ProductSecurity/content/Fujitsu-PSIRT-FCCL-IS-2021-090903-Security-Advisory.asp"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.binarly.io/advisories"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.kb.cert.org/vuls/id/796611"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}