CVE-2024-52880 - Vulnerability Details - OpenCVE

An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel 5.5 before version 05.54.50, kernel 5.6 before version 05.61.50, and kernel 5.7 before version 05.70.50. In VariableRuntimeDxe driver, SecureBootHandler uses DataSize and VariableNameSize when determining if the data or name are in the buffer, but these are supplied by the caller and therefore cannot be trusted.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00031.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Insyde	Insydeh2o Kernel

Configuration 1 [-]

cpe:2.3:o:insyde:kernel:*:*:*:*:*:*:*:*

Configuration 2 [-]

cpe:2.3:o:insyde:kernel:*:*:*:*:*:*:*:*

Configuration 3 [-]

cpe:2.3:o:insyde:kernel:*:*:*:*:*:*:*:*

Configuration 4 [-]

cpe:2.3:o:insyde:kernel:*:*:*:*:*:*:*:*

Configuration 5 [-]

cpe:2.3:o:insyde:kernel:*:*:*:*:*:*:*:*

Configuration 6 [-]

cpe:2.3:o:insyde:kernel:*:*:*:*:*:*:*:*

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors	Products
Insyde	Insydeh2o

Advisories

Source	ID	Title
EUVD	EUVD-2024-54544	An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel 5.5 before version 05.54.50, kernel 5.6 before version 05.61.50, and kernel 5.7 before version 05.70.50. In VariableRuntimeDxe driver, SecureBootHandler uses DataSize and VariableNameSize when determining if the data or name are in the buffer, but these are supplied by the caller and therefore cannot be trusted.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.insyde.com/security-pledge
https://www.insyde.com/security-pledge/sa-2024016/

History

Tue, 29 Jul 2025 13:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Insyde kernel
CPEs		cpe:2.3:o:insyde:kernel::::::::
Vendors & Products		Insyde kernel

Fri, 16 May 2025 15:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-20
Metrics		cvssV3_1 `{'score': 7.9, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 15 May 2025 16:00:00 +0000

Type	Values Removed	Values Added
Description		An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel 5.5 before version 05.54.50, kernel 5.6 before version 05.61.50, and kernel 5.7 before version 05.70.50. In VariableRuntimeDxe driver, SecureBootHandler uses DataSize and VariableNameSize when determining if the data or name are in the buffer, but these are supplied by the caller and therefore cannot be trusted.
References		https://www.insyde.com/security-pledge https://www.insyde.com/security-pledge/sa-2024016/

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2025-05-15T00:00:00.000Z

Updated: 2025-05-16T14:19:59.789Z

Reserved: 2024-11-17T00:00:00.000Z

Link: CVE-2024-52880

Vulnrichment

Updated: 2025-05-16T14:18:53.094Z

NVD

Status : Analyzed

Published: 2025-05-15T16:15:33.143

Modified: 2025-07-29T13:09:06.557

Link: CVE-2024-52880

Redhat

No data.

OpenCVE Enrichment

Updated: 2025-07-12T22:23:22Z

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:insyde:kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E2EFE045-135C-419F-9BB0-7E11A22A98C0", "versionEndExcluding": "5.29.50", "versionStartIncluding": "5.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:insyde:kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4702B5B6-5BE8-47F6-8FD3-0720D1EB0844", "versionEndExcluding": "5.38.50", "versionStartIncluding": "5.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:insyde:kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "949C566E-8F6E-4794-8780-5FA7841D149D", "versionEndExcluding": "5.46.50", "versionStartIncluding": "5.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:insyde:kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "538D70A7-17B4-45AC-B446-CF687AEC43B7", "versionEndExcluding": "5.54.50", "versionStartIncluding": "5.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:insyde:kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9F0E7B47-C2D1-492F-B297-8FCAD69E681C", "versionEndExcluding": "5.61.50", "versionStartIncluding": "5.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:insyde:kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2BA744F1-4260-40BB-81E6-3F334892B958", "versionEndExcluding": "5.70.50", "versionStartIncluding": "5.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel 5.5 before version 05.54.50, kernel 5.6 before version 05.61.50, and kernel 5.7 before version 05.70.50. In VariableRuntimeDxe driver, SecureBootHandler uses DataSize and VariableNameSize when determining if the data or name are in the buffer, but these are supplied by the caller and therefore cannot be trusted."}, {"lang": "es", "value": "Se detect\u00f3 un problema en Insyde InsydeH2O en las versiones del kernel 5.2 anterior a la 05.29.50, 5.3 anterior a la 05.38.50, 5.4 anterior a la 05.46.50, 5.5 anterior a la 05.54.50, 5.6 anterior a la 05.61.50 y 5.7 anterior a la 05.70.50. En el controlador VariableRuntimeDxe, SecureBootHandler utiliza DataSize y VariableNameSize para determinar si los datos o el nombre est\u00e1n en el b\u00fafer, pero estos son proporcionados por el emisor y, por lo tanto, no son confiables."}], "id": "CVE-2024-52880", "lastModified": "2025-07-29T13:09:06.557", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.9, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.5, "impactScore": 5.8, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2025-05-15T16:15:33.143", "references": [{"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://www.insyde.com/security-pledge"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://www.insyde.com/security-pledge/sa-2024016/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}