InsydeH2O Tools Buffer Overflow Vulnerability in H2OFFT64.sys

A buffer overflow vulnerability has been identified in the InsydeH2O tools, specifically in the H2OFFT64.sys driver. This vulnerability arises because the driver uses the RTL_QUERY_REGISTRY_DIRECT flag to read a registry value, which an untrusted user-mode application may exploit to cause a buffer overflow.

Impact

Exploitation of this vulnerability could lead to a buffer overflow, allowing for potential arbitrary code execution or causing a crash.

Remediation

Users are advised to update to version 200.02.01.00 or newer. For those using HP tools, the following versions should be used: HP FlashWin 6.51.00, HP Readback tool 1.2.4.0, HP FlashVerifyUtility 6.2.5.0, or HP IsSecureBootKeyInstaller 1.2.0.2.