Is CVE-2022-30283 actively exploited?

No active exploitation of CVE-2022-30283 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2022-30283 be exploited remotely?

No. CVE-2022-30283 requires local access to exploit.

What is the CVSS score of CVE-2022-30283?

CVE-2022-30283 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2022-30283

HIGH

CVE-2022-30283

CWE-367Published: November 15, 2022· Updated: Jun 17, 2026

7.5

CVSS v3.1

Official Description

In UsbCoreDxe, tampering with the contents of the USB working buffer using DMA while certain USB transactions are in process leads to a TOCTOU problem that could be used by an attacker to cause SMRAM corruption and escalation of privileges The UsbCoreDxe module creates a working buffer for USB transactions outside of SMRAM. The code which uses can be inside of SMM, making the working buffer untrusted input. The buffer can be corrupted by DMA transfers. The SMM code code attempts to sanitize pointers to ensure all pointers refer to the working buffer, but when a pointer is not found in the list of pointers to sanitize, the current action is not aborted, leading to undefined behavior. This issue was discovered by Insyde engineering based on the general description provided by Intel's iSTARE group. Fixed in: Kernel 5.0: Version 05.09. 21 Kernel 5.1: Version 05.17.21 Kernel 5.2: Version 05.27.21 Kernel 5.3: Version 05.36.21 Kernel 5.4: Version 05.44.21 Kernel 5.5: Version 05.52.21 https://www.insyde.com/security-pledge/SA-2022063

NVD Source

Technical Analysis

CVE-2022-30283 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires high privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.5.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.