CVE-2022-24069: n/a SMM callout enables privilege

Q: Is CVE-2022-24069 actively exploited?

No confirmed active exploitation of CVE-2022-24069 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2022-24069?

1) Inventory AI/ML compute (training servers, GPU nodes, inference appliances, edge devices) for OEM systems using InsydeH2O firmware. 2) Check installed firmware version against your OEM's advisory and update to a build incorporating the fixed InsydeH2O kernel (05.08.41+/05.16.29+/05.26.29+/05.35.29+/05.43.29+/05.51.29+ depending on branch). 3) Apply vendor-specific BIOS/UEFI updates from your hardware OEM (Insyde is an IBV supplying firmware to many OEMs — check Dell, HP, Lenovo, Supermicro, etc. advisories referencing this CVE). 4) Restrict local admin/kernel-level access on AI infrastructure hosts since exploitation requires that level of access. 5) Where available, enable SMM protections (SMM_Code_Access_Check, BIOS write protection) and firmware integrity/attestation monitoring. 6) No detection signature exists for this at the network or EDR layer — this is a patch-management control, not a detection one.

Q: What systems are affected by CVE-2022-24069?

This vulnerability affects the following AI/ML architecture patterns: model serving, training pipelines.

Q: What is the CVSS score for CVE-2022-24069?

No CVSS score has been assigned yet.

CISO Take

This is a System Management Mode (SMM) callout vulnerability in AhciBusDxe, a core storage driver component of Insyde InsydeH2O UEFI firmware used across a wide range of OEM servers, workstations, and laptops. A local attacker with kernel/administrator-level access can hijack the SMM execution flow to escalate privileges to ring -2, below the operating system and hypervisor, effectively achieving full, persistent control of the physical host that survives OS reinstalls. There is no direct evidence this targets AI/ML software specifically, but any GPU training cluster, inference server, or edge AI appliance running affected InsydeH2O firmware inherits this exposure at the hardware root-of-trust layer, which is a meaningful concern for AI infrastructure integrity and supply-chain assurance. EPSS sits at 0.3% (top 77th percentile, still low absolute probability), it is not in CISA KEV, and no public exploit or Nuclei template exists, so treat this as a patch-cycle item rather than an active-exploitation emergency. Action: identify AI/ML hosts and edge devices running InsydeH2O firmware, confirm OEM firmware versions against the fixed kernel ranges (5.0<05.08.41, 5.1<05.16.29, 5.2<05.26.29, 5.3<05.35.29, 5.4<05.43.29, 5.5<05.51.29), and apply OEM BIOS/UEFI updates during the next maintenance window.

Sources:NVDEPSS

What is the risk?

Low near-term exploitation likelihood (EPSS 0.3%, not in KEV, no public PoC or scanner coverage) but high potential impact if exploited, since SMM compromise grants persistent, OS-independent control beneath any AI/ML software stack. Requires local privileged access to trigger, which limits remote mass exploitation but makes it relevant in multi-tenant GPU/inference infrastructure or supply-chain scenarios where an attacker already has a foothold.

How does the attack unfold?

Initial Access

Attacker obtains local kernel/administrator-level access to a host running vulnerable InsydeH2O firmware, such as an AI training server or inference appliance.

SMM Callout Exploitation

Attacker triggers the AhciBusDxe SMM callout flaw to hijack execution flow and run arbitrary code in System Management Mode.

Firmware Persistence

Attacker installs a persistent, OS-independent implant in firmware, surviving OS reinstalls and evading OS-level security tooling.

AML.T0010.000

Impact

Compromised platform integrity undermines trust assumptions for any AI/ML workloads and attestation running on the host, enabling covert long-term control.

Initial Access

Attacker obtains local kernel/administrator-level access to a host running vulnerable InsydeH2O firmware, such as an AI training server or inference appliance.

SMM Callout Exploitation

Attacker triggers the AhciBusDxe SMM callout flaw to hijack execution flow and run arbitrary code in System Management Mode.

Firmware Persistence

Attacker installs a persistent, OS-independent implant in firmware, surviving OS reinstalls and evading OS-level security tooling.

AML.T0010.000

Impact

Compromised platform integrity undermines trust assumptions for any AI/ML workloads and attestation running on the host, enabling covert long-term control.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n/a	—	—	No patch

Do you use n/a? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.3%

chance of exploitation in 30 days

Higher than 23% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Advanced

What should I do?

1 step

1) Inventory AI/ML compute (training servers, GPU nodes, inference appliances, edge devices) for OEM systems using InsydeH2O firmware. 2) Check installed firmware version against your OEM's advisory and update to a build incorporating the fixed InsydeH2O kernel (05.08.41+/05.16.29+/05.26.29+/05.35.29+/05.43.29+/05.51.29+ depending on branch). 3) Apply vendor-specific BIOS/UEFI updates from your hardware OEM (Insyde is an IBV supplying firmware to many OEMs — check Dell, HP, Lenovo, Supermicro, etc. advisories referencing this CVE). 4) Restrict local admin/kernel-level access on AI infrastructure hosts since exploitation requires that level of access. 5) Where available, enable SMM protections (SMM_Code_Access_Check, BIOS write protection) and firmware integrity/attestation monitoring. 6) No detection signature exists for this at the network or EDR layer — this is a patch-management control, not a detection one.

How is it classified?

Code ExecutionInferenceTraining DataAML.T0010.000- Hardware

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring / infrastructure security

NIST AI RMF

MAP 3.4-Third-party/infrastructure risks are mapped and monitored

Frequently Asked Questions

What is CVE-2022-24069?

This is a System Management Mode (SMM) callout vulnerability in AhciBusDxe, a core storage driver component of Insyde InsydeH2O UEFI firmware used across a wide range of OEM servers, workstations, and laptops. A local attacker with kernel/administrator-level access can hijack the SMM execution flow to escalate privileges to ring -2, below the operating system and hypervisor, effectively achieving full, persistent control of the physical host that survives OS reinstalls. There is no direct evidence this targets AI/ML software specifically, but any GPU training cluster, inference server, or edge AI appliance running affected InsydeH2O firmware inherits this exposure at the hardware root-of-trust layer, which is a meaningful concern for AI infrastructure integrity and supply-chain assurance. EPSS sits at 0.3% (top 77th percentile, still low absolute probability), it is not in CISA KEV, and no public exploit or Nuclei template exists, so treat this as a patch-cycle item rather than an active-exploitation emergency. Action: identify AI/ML hosts and edge devices running InsydeH2O firmware, confirm OEM firmware versions against the fixed kernel ranges (5.0<05.08.41, 5.1<05.16.29, 5.2<05.26.29, 5.3<05.35.29, 5.4<05.43.29, 5.5<05.51.29), and apply OEM BIOS/UEFI updates during the next maintenance window.

Is CVE-2022-24069 actively exploited?

No confirmed active exploitation of CVE-2022-24069 has been reported, but organizations should still patch proactively.

How to fix CVE-2022-24069?

1) Inventory AI/ML compute (training servers, GPU nodes, inference appliances, edge devices) for OEM systems using InsydeH2O firmware. 2) Check installed firmware version against your OEM's advisory and update to a build incorporating the fixed InsydeH2O kernel (05.08.41+/05.16.29+/05.26.29+/05.35.29+/05.43.29+/05.51.29+ depending on branch). 3) Apply vendor-specific BIOS/UEFI updates from your hardware OEM (Insyde is an IBV supplying firmware to many OEMs — check Dell, HP, Lenovo, Supermicro, etc. advisories referencing this CVE). 4) Restrict local admin/kernel-level access on AI infrastructure hosts since exploitation requires that level of access. 5) Where available, enable SMM protections (SMM_Code_Access_Check, BIOS write protection) and firmware integrity/attestation monitoring. 6) No detection signature exists for this at the network or EDR layer — this is a patch-management control, not a detection one.

What systems are affected by CVE-2022-24069?

This vulnerability affects the following AI/ML architecture patterns: model serving, training pipelines.

What is the CVSS score for CVE-2022-24069?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

model servingtraining pipelines

MITRE ATLAS Techniques

AML.T0010.000Hardware

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MAP 3.4

What are the technical details?

Original Advisory

An issue was discovered in AhciBusDxe in Insyde InsydeH2O with kernel 5.0 before 05.08.41, 5.1 before 05.16.29, 5.2 before 05.26.29, 5.3 before 05.35.29, 5.4 before 05.43.29, and 5.5 before 05.51.29. An SMM callout vulnerability allows an attacker to hijack the execution flow of code running in System Management Mode. Exploiting this issue could lead to escalating privileges to SMM.

Exploitation Scenario

An adversary who has already gained privileged local or kernel-mode access to an AI training or inference server (e.g., via a separate initial-access vector, malicious container escape, or insider access) leverages the AhciBusDxe SMM callout flaw to redirect SMI handler execution and run arbitrary code in System Management Mode. From SMM, the attacker installs a persistent firmware-level implant that survives OS reimaging, disables or falsifies platform attestation, and maintains covert control over the AI infrastructure host — potentially enabling later tampering with model artifacts, credentials, or the ML pipeline without detection by OS-level security tooling.