A stack buffer overflow vulnerability discovered in AsfSecureBootDxe in Insyde InsydeH2O with kernel 5.0 through 5.5 allows attackers to run arbitrary code execution during the DXE phase.
The product writes data past the end, or before the beginning, of the intended buffer.
A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
| Link | Tags |
|---|---|
| https://www.insyde.com/security-pledge | vendor advisory |
| https://www.insyde.com/security-pledge/SA-2023054 | vendor advisory |