Insydeh2o CVE-2024-55567

CVSS 7.5 is elevated but constrained by attack vector (Local) and privilege requirements (High). The CVSS vector (AV:L/AC:H/PR:H/UI:N/S:C) indicates this requires local system access and high privileges (administrator or BIOS settings access), with high complexity (AC:H), significantly reducing real-world exploitability compared to network-based vulnerabilities. However, the scope change (S:C) and impact ratings (C:H/I:H/A:H) reflect the critical consequence—complete confidentiality, integrity, and availability compromise at SMM level, making this a kernel-level code execution vulnerability. Without confirmed EPSS data, KEV listing, or public POC, this appears to be a 'high-impact, moderate-probability' risk rather than an actively exploited threat. The vulnerability is most dangerous in scenarios where an attacker has already achieved local code execution or firmware modification privileges, making it a secondary escalation vector rather than a primary entry point. Organizations should prioritize this for systems in high-security environments (e.g., enterprise servers, sensitive workstations) where firmware integrity is critical, but the attack vector constraints make it lower priority than remote exploits.

An attacker with local administrative privileges on a Windows/Linux system (e.g., through social engineering or prior compromise) connects a maliciously crafted USB device with forged descriptors or loads a malicious UEFI application. The exploit leverages improper input validation in UsbCoreDxe to send invalid parameters via SMM call handlers, triggering an out-of-bounds write into SMRAM. This allows the attacker to overwrite SMM code or hook SMM functions, enabling arbitrary code execution at System Management Mode privilege level, which persists across OS reboots and can intercept all system calls. From SMM, the attacker can disable security features (e.g., Secure Boot, DEP), modify kernel code, or exfiltrate encryption keys stored in firmware. The high complexity (AC:H) requirement suggests specific timing, alignment, or hardware conditions must be met, but no public POC is known to reduce this barrier. This vulnerability is most exploitable in targeted attacks against high-value systems where the attacker can pre-position hardware or has legitimate local access (e.g., supply chain compromise, insider threats).