CVE-2023-28468

Name of the Vulnerable Software and Affected Versions Insyde InsydeH2O versions 5.0 through 5.5

Description An issue was discovered in FvbServicesRuntimeDxe, which is an SMM module that exposes an SMI handler. This handler allows an attacker to interact with the SPI flash at run-time from the OS.

Recommendations For versions 5.0 through 5.5, consider disabling the FvbServicesRuntimeDxe SMM module as a temporary workaround until a patch is available. Restrict access to the SMI handler to minimize the risk of exploitation.