CVE-2024-49200
Published Apr 15, 2025
CVSS 3.1 · 6.4 Medium
EPSS < 1%
KEV · Not listed
Description
An issue was discovered in AcpiS3SaveDxe and ChipsetSvcDxe in Insyde InsydeH2O with kernel 5.2 though 5.7. A potential DXE memory corruption vulnerability has been identified. The root cause is use of a pointer originating from the value of an NVRAM variable as the target of a write operation. This can be leveraged by an attacker to perform arbitrary writes, potentially leading to arbitrary code execution. The issue has been fixed in kernel 5.2, Version 05.29.44; kernel 5.3, Version 05.38.44; kernel 5.4, Version 05.46.44; kernel 5.5, Version 05.54.44; kernel 5.6, Version 05.61.44; and kernel 5.7, Version 05.70.44.
Affected Products
-
CVE record
-
NVD configurations
-
Red Hat packages
No data
-
OpenCVE enrichment
No data
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| n/a | n/a | affected |
|
Configuration 1 [-]
|
No data.
No data available yet.
Remediation
Tracking
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2025-11151 | An issue was discovered in AcpiS3SaveDxe and ChipsetSvcDxe in Insyde InsydeH2O with kernel 5.2 though 5.7. A potential DXE memory corruption vulnerability has been identified. The root cause is use of a pointer originating from the value of an NVRAM variable as the target of a write operation. This can be leveraged by an attacker to perform arbitrary writes, potentially leading to arbitrary code execution. The issue has been fixed in kernel 5.2, Version 05.29.44; kernel 5.3, Version 05.38.44; kernel 5.4, Version 05.46.44; kernel 5.5, Version 05.54.44; kernel 5.6, Version 05.61.44; and kernel 5.7, Version 05.70.44. |
Metrics
No CVSS v4.0
Attack Vector Network
Attack Complexity High
Privileges Required Low
Scope Unchanged
Confidentiality Impact High
Integrity Impact High
Availability Impact None
User Interaction Required
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.463% probability within 30 days)
Exploitation none
Automatable yes
Technical Impact total
References
| Link | Providers |
|---|---|
| https://www.insyde.com/security-pledge/SA-2024015 |
|
History
Apr 30, 2025 5:00 PM
First appearance in the feed. Affected versions updated. Affected vendors updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Insyde
Insyde kernel |
|
| CPEs | cpe:2.3:o:insyde:kernel:5.2:*:*:*:*:*:*:* cpe:2.3:o:insyde:kernel:5.3:*:*:*:*:*:*:* cpe:2.3:o:insyde:kernel:5.4:*:*:*:*:*:*:* cpe:2.3:o:insyde:kernel:5.5:*:*:*:*:*:*:* cpe:2.3:o:insyde:kernel:5.6:*:*:*:*:*:*:* cpe:2.3:o:insyde:kernel:5.7:*:*:*:*:*:*:* |
|
| Vendors & Products |
Insyde
Insyde kernel |
Apr 16, 2025 7:15 PM
Weaknesses updated. Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-787 | |
| Metrics |
cvssV3_1
|
Apr 15, 2025 10:15 PM
Description updated. Added references
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An issue was discovered in AcpiS3SaveDxe and ChipsetSvcDxe in Insyde InsydeH2O with kernel 5.2 though 5.7. A potential DXE memory corruption vulnerability has been identified. The root cause is use of a pointer originating from the value of an NVRAM variable as the target of a write operation. This can be leveraged by an attacker to perform arbitrary writes, potentially leading to arbitrary code execution. The issue has been fixed in kernel 5.2, Version 05.29.44; kernel 5.3, Version 05.38.44; kernel 5.4, Version 05.46.44; kernel 5.5, Version 05.54.44; kernel 5.6, Version 05.61.44; and kernel 5.7, Version 05.70.44. | |
| References |
|
Weaknesses
