« Volver al listado

CVE-2024-27353

Estado: AplazadaAlta (7.4)—

A memory corruption vulnerability in SdHost and SdMmcDevice in Insyde InsydeH2O kernel 5.2 before 05.29.09, kernel 5.3 before 05.38.09, kernel 5.4 before 05.46.09, kernel 5.5 before 05.54.09, and kernel 5.6 before 05.61.09 could lead to escalating privileges in SMM.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Insyde — Insydeh2oAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-27353",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-27353",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-05-15T17:58:14.806532Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.4,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:L",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "LOW",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 0.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:insyde:insydeh2o:5.2:*:*:*:*:*:*:*"
          ],
          "vendor": "insyde",
          "product": "insydeh2o",
          "versions": [
            {
              "status": "affected",
              "version": "5.2",
              "lessThan": "05.38.09",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:insyde:insydeh2o:5.3:*:*:*:*:*:*:*"
          ],
          "vendor": "insyde",
          "product": "insydeh2o",
          "versions": [
            {
              "status": "affected",
              "version": "5.3",
              "lessThan": "05.46.09",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:insyde:insydeh2o:5.4:*:*:*:*:*:*:*"
          ],
          "vendor": "insyde",
          "product": "insydeh2o",
          "versions": [
            {
              "status": "affected",
              "version": "5.4",
              "lessThan": "05.54.09",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:insyde:insydeh2o:5.5:*:*:*:*:*:*:*"
          ],
          "vendor": "insyde",
          "product": "insydeh2o",
          "versions": [
            {
              "status": "affected",
              "version": "5.5",
              "lessThan": "05.29.09",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:insyde:insydeh2o:5.6:*:*:*:*:*:*:*"
          ],
          "vendor": "insyde",
          "product": "insydeh2o",
          "versions": [
            {
              "status": "affected",
              "version": "5.6",
              "lessThan": "05.61.09",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-05-15T15:15:08.097",
  "references": [
    {
      "url": "https://www.insyde.com/security-pledge",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.insyde.com/security-pledge/SA-2024001",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.insyde.com/security-pledge",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.insyde.com/security-pledge/SA-2024001",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-822"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A memory corruption vulnerability in SdHost and SdMmcDevice in Insyde InsydeH2O kernel 5.2 before 05.29.09, kernel 5.3 before 05.38.09, kernel 5.4 before 05.46.09, kernel 5.5 before 05.54.09, and kernel 5.6 before 05.61.09 could lead to escalating privileges in SMM."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de corrupción de memoria en SdHost y SdMmcDevice en Insyde InsydeH2O kernel 5.2 anterior al 29.05.09, kernel 5.3 anterior al 38.05.09, kernel 5.4 anterior al 05.46.09, kernel 5.5 anterior al 05.54.09 y kernel 5.6 anterior al 05.61.09 podría provocar una escalada privilegios en SMM."
    }
  ],
  "lastModified": "2026-06-17T07:19:42.790",
  "sourceIdentifier": "cve@mitre.org"
}