CVE-2024-52878 Details
Description
An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel 5.5 before version 05.54.50, kernel 5.6 before version 05.61.50, and kernel 5.7 before version 05.70.50. In VariableRuntimeDxe driver, VariableServicesSetVariable () can be called by gRT_>SetVariable () or the SmmSetSensitiveVariable () or SmmInternalSetVariable () from SMM. In VariableServicesSetVariable (), it uses StrSize () to get variable name size, uses StrLen () to get variable name length and uses StrCmp () to compare strings. These actions may cause a buffer over-read.
A buffer over-read vulnerability has been identified in the InsydeH2O firmware, specifically in the VariableRuntimeDxe driver. This issue affects several kernel versions prior to their respective fixed releases. The vulnerability arises because the VariableServicesSetVariable function can be invoked by gRT_SetVariable or through SMM (System Management Mode) sensitive variable functions. Within VariableServicesSetVariable, unsafe string handling functions are used, which may lead to a buffer over-read condition.
Users can upgrade to InsydeH2O kernel versions 5.2 (through 05.29.50), 5.3 (through 05.38.50), 5.4 (through 05.46.50), 5.5 (through 05.54.50), 5.6 (through 05.61.50), or 5.7 (through 05.70.50) to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 19, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.insyde.com/security-pledge | [email protected] | Vendor Advisory |
| https://www.insyde.com/security-pledge/sa-2024016/ | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-126 | Buffer Over-read | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| insyde insydeh2o | >= 5.2, < 5.2.05.29.50 >= 5.3, < 5.3.05.38.50 >= 5.4, < 5.4.05.46.50 >= 5.5, < 5.5.05.54.50 >= 5.6, < 5.6.05.61.50 >= 5.7, < 5.7.05.70.50 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Aug 15, 2025 | Initial Analysis | [email protected] |
| May 19, 2025 | CVE Modified | CISA-ADP |
| May 15, 2025 | New CVE Received | [email protected] |