CVE-2022-29277

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-11-15 · updated 2026-06-17
Weakness: CWE-787

Description

Incorrect pointer checks within the the FwBlockServiceSmm driver can allow arbitrary RAM modifications During review of the FwBlockServiceSmm driver, certain instances of SpiAccessLib could be tricked into writing 0xff to arbitrary system and SMRAM addresses. Fixed in: INTEL Purley-R: 05.21.51.0048 Whitley: 05.42.23.0066 Cedar Island: 05.42.11.0021 Eagle Stream: 05.44.25.0052 Greenlow/Greenlow-R(skylake/kabylake): Trunk Mehlow/Mehlow-R (CoffeeLake-S): Trunk Tatlow (RKL-S): Trunk Denverton: 05.10.12.0042 Snow Ridge: Trunk Graneville DE: 05.05.15.0038 Grangeville DE NS: 05.27.26.0023 Bakerville: 05.21.51.0026 Idaville: 05.44.27.0030 Whiskey Lake: Trunk Comet Lake-S: Trunk Tiger Lake H/UP3: 05.43.12.0052 Alder Lake: 05.44.23.0047 Gemini Lake: Not Affected Apollo Lake: Not Affected Elkhart Lake: 05.44.30.0018 AMD ROME: trunk MILAN: 05.36.10.0017 GENOA: 05.52.25.0006 Snowy Owl: Trunk R1000: 05.32.50.0018 R2000: 05.44.30.0005 V2000: Trunk V3000: 05.44.30.0007 Ryzen 5000: 05.44.30.0004 Embedded ROME: Trunk Embedded MILAN: Trunk Hygon Hygon #1/#2: 05.36.26.0016 Hygon #3: 05.44.26.0007 https://www.insyde.com/security-pledge/SA-2022060

Affected products

AMD Genoa Firmware: before 05.52.25.0006 — fixed in 05.52.25.0006
AMD Hygon 1 Firmware: before 05.36.26.0016 — fixed in 05.36.26.0016
AMD Hygon 2 Firmware: before 05.36.26.0016 — fixed in 05.36.26.0016
AMD Hygon 3 Firmware: before 05.44.26.0007 — fixed in 05.44.26.0007
AMD Milan Firmware: before 05.36.10.0017; before 05.36.26.0016 — fixed in 05.36.10.0017, 05.36.26.0016
AMD Rome Firmware: before 05.36.10.0017; before 05.36.26.0016 — fixed in 05.36.10.0017, 05.36.26.0016
AMD Ryzen 5300G Firmware: before 05.44.30.0004 — fixed in 05.44.30.0004
AMD Ryzen 5300Ge Firmware: before 05.44.30.0004 — fixed in 05.44.30.0004
AMD Ryzen 5600G Firmware: before 05.44.30.0004 — fixed in 05.44.30.0004
AMD Ryzen 5600Ge Firmware: before 05.44.30.0004 — fixed in 05.44.30.0004
AMD Ryzen 5600X Firmware: before 05.44.30.0004 — fixed in 05.44.30.0004
AMD Ryzen 5700G Firmware: before 05.44.30.0004 — fixed in 05.44.30.0004
AMD Ryzen 5700Ge Firmware: before 05.44.30.0004 — fixed in 05.44.30.0004
AMD Ryzen 5800X3D Firmware: before 05.44.30.0004 — fixed in 05.44.30.0004
AMD Ryzen 5800X Firmware: before 05.44.30.0004 — fixed in 05.44.30.0004
AMD Ryzen 5900X Firmware: before 05.44.30.0004 — fixed in 05.44.30.0004
AMD Ryzen 5950X Firmware: before 05.44.30.0004 — fixed in 05.44.30.0004
AMD Snowy Owl R1000 Firmware: before 05.32.50.0018 — fixed in 05.32.50.0018
AMD Snowy Owl R2000 Firmware: before 05.44.30.0005 — fixed in 05.44.30.0005
AMD Snowy Owl V2000 Firmware: before 05.44.30.0007 — fixed in 05.44.30.0007
AMD Snowy Owl V3000 Firmware: before 05.44.30.0007 — fixed in 05.44.30.0007
Intel Alder Lake Firmware: before 05.44.23.0047 — fixed in 05.44.23.0047
Intel Bakerville Firmware: before 05.21.51.0026 — fixed in 05.21.51.0026
Intel Cedar Island Firmware: before 05.42.11.0021 — fixed in 05.42.11.0021
Intel Comet Lake-S Firmware: before 05.43.12.0052 — fixed in 05.43.12.0052
Intel Denverton Firmware: before 05.10.12.0042 — fixed in 05.10.12.0042
Intel Eagle Stream Firmware: before 05.44.25.0052 — fixed in 05.44.25.0052
Intel Grangeville De Ns Firmware: before 05.27.26.0023 — fixed in 05.27.26.0023
Intel Granville De Firmware: before 05.05.15.0038 — fixed in 05.05.15.0038
Intel Greenlow-R Firmware: before 05.10.12.0042 — fixed in 05.10.12.0042

How to fix

Upgrade to a fixed version: AMD Genoa Firmware 05.52.25.0006; AMD Hygon 1 Firmware 05.36.26.0016; AMD Hygon 2 Firmware 05.36.26.0016; AMD Hygon 3 Firmware 05.44.26.0007; AMD Milan Firmware 05.36.10.0017, 05.36.26.0016; AMD Rome Firmware 05.36.10.0017, 05.36.26.0016; AMD Ryzen 5300G Firmware 05.44.30.0004; AMD Ryzen 5300Ge Firmware 05.44.30.0004; AMD Ryzen 5600G Firmware 05.44.30.0004; AMD Ryzen 5600Ge Firmware 05.44.30.0004; AMD Ryzen 5600X Firmware 05.44.30.0004; AMD Ryzen 5700G Firmware 05.44.30.0004. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-29277 or the next vulnerability affects your stack