CVE-2022-28806 : An issue was discovered on certain Fujitsu LIEFBOOK devices (A3510, U9310, U7511

An issue was discovered on certain Fujitsu LIEFBOOK devices (A3510, U9310, U7511/U7411/U7311, U9311, E5510/E5410, U7510/U7410/U7310, E459/E449) with BIOS versions before v1.09 (A3510), v2.17 (U9310), v2.30 (U7511/U7411/U7311), v2.33 (U9311), v2.23 (E5510), v2.19 (U7510/U7410), v2.13 (U7310), and v1.09 (E459/E449). The FjGabiFlashCoreAbstractionSmm driver registers a Software System Management Interrupt (SWSMI) handler that is not sufficiently validated to ensure that the CommBuffer (or any other communication buffer's nested contents) are not pointing to SMRAM contents. A potential attacker can therefore write fixed data to SMRAM, which could lead to data corruption inside this memory (e.g., change the SMI handler's code or modify SMRAM map structures to break input pointer validation for other SMI handlers). Thus, the attacker could elevate privileges from ring 0 to ring -2 and execute arbitrary code in SMM.

Published 2022-05-04 15:15:13

Updated 2022-05-18 13:26:13

Source MITRE

View at NVD, CVE.org

Vulnerability category: Memory CorruptionExecute code

Products affected by CVE-2022-28806

Fujitsu » Lifebook A3510 Firmware
Versions before (<) 1.09
cpe:2.3:o:fujitsu:lifebook_a3510_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Fujitsu » Lifebook A3510 » Version: N/A
Fujitsu » Lifebook U9310 Firmware
Versions before (<) 2.17
cpe:2.3:o:fujitsu:lifebook_u9310_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Fujitsu » Lifebook U9310 » Version: N/A
Fujitsu » Lifebook U7511 Firmware
Versions before (<) 2.30
cpe:2.3:o:fujitsu:lifebook_u7511_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Fujitsu » Lifebook U7511 » Version: N/A
Fujitsu » Lifebook U7411 Firmware
Versions before (<) 2.30
cpe:2.3:o:fujitsu:lifebook_u7411_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Fujitsu » Lifebook U7411 » Version: N/A
Fujitsu » Lifebook U7311 Firmware
Versions before (<) 2.30
cpe:2.3:o:fujitsu:lifebook_u7311_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Fujitsu » Lifebook U7311 » Version: N/A
Fujitsu » Lifebook U9311 Firmware
Versions up to, including, (<=) 2.33
cpe:2.3:o:fujitsu:lifebook_u9311_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Fujitsu » Lifebook U9311 » Version: N/A
Fujitsu » Lifebook E5510 Firmware
Versions before (<) 2.23
cpe:2.3:o:fujitsu:lifebook_e5510_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Fujitsu » Lifebook E5510 » Version: N/A
Fujitsu » Lifebook U7510 Firmware
Versions before (<) 2.19
cpe:2.3:o:fujitsu:lifebook_u7510_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Fujitsu » Lifebook U7510 » Version: N/A
Fujitsu » Lifebook U7410 Firmware
Versions before (<) 2.19
cpe:2.3:o:fujitsu:lifebook_u7410_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Fujitsu » Lifebook U7410 » Version: N/A
Fujitsu » Lifebook U7310 Firmware
Versions before (<) 2.13
cpe:2.3:o:fujitsu:lifebook_u7310_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Fujitsu » Lifebook U7310 » Version: N/A
Fujitsu » Lifebook E459 Firmware
Versions before (<) 1.09
cpe:2.3:o:fujitsu:lifebook_e459_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Fujitsu » Lifebook E459 » Version: N/A
Fujitsu » Lifebook E449 Firmware
Versions before (<) 1.09
cpe:2.3:o:fujitsu:lifebook_e449_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Fujitsu » Lifebook E449 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2022-28806

EPSS FAQ

0.09%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 40 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-28806

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.2	HIGH	AV:L/AC:L/Au:N/C:C/I:C/A:C	3.9	10.0	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2022-28806

CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2022-28806

https://support.ts.fujitsu.com/ProductSecurity/content/Fujitsu-PSIRT-FCCL-IS-2021-090903-Security-Advisory.asp

Fujitsu Technical Support pages from Fujitsu Great Britain and Northern Ireland
Vendor Advisory
http://www.fmworld.net/biz/common/insyde/20220210/

Insyde社のUEFI（InsydeH2O）に関する脆弱性のお知らせ（CVE-2021-41837他） - FMWORLD（法人）:富士通
Vendor Advisory
https://www.binarly.io/advisories

Binarly | AI-Powered Firmware Protection
Exploit;Third Party Advisory
https://kb.cert.org/vuls/id/796611

VU#796611 - InsydeH2O UEFI software impacted by multiple vulnerabilities in SMM
Third Party Advisory;US Government Resource

Jump to

Vulnerability Details : CVE-2022-28806

Products affected by CVE-2022-28806

Exploit prediction scoring system (EPSS) score for CVE-2022-28806

CVSS scores for CVE-2022-28806

CWE ids for CVE-2022-28806

References for CVE-2022-28806