🛡️ CVE-2023-40238
5.5
CVSS Score
0 Low4 Medium7 High9 Critical10
Description
A LogoFAIL issue was discovered in BmpDecoderDxe in Insyde InsydeH2O with kernel 5.2 before 05.28.47, 5.3 before 05.37.47, 5.4 before 05.45.47, 5.5 before 05.53.47, and 5.6 before 05.60.47 for certain Lenovo devices. Image parsing of crafted BMP logo files can copy data to a specific address during the DXE phase of UEFI execution. This occurs because of an integer signedness error involving PixelHeight and PixelWidth during RLE4/RLE8 compression.
Details
Severity
MEDIUM
CVSS Score
5.5
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE
CWE-312
Public Exploit
⚠️ Yes
Source
NVD
Published
2023-12-07
Updated
2026-06-08
Modified
2026-02-25
Fix URL
N/A
Affected Packages
| Software | From version | Fixed in |
|---|---|---|
| celsius-c780-firmware | — | 1.28.0 |
| celsius-h5511-firmware | — | 1.16 |
| celsius-h7510-firmware | — | 1.17 |
| celsius-h7613-firmware | — | 1.14 |
| celsius-h780-firmware | — | 1.23 |
| celsius-h980-firmware | — | — |
| celsius-j5010-firmware | — | 1.64.0 |
| celsius-j550\/2-firmware | — | 1.35.0 |
| celsius-j580-firmware | — | 1.38.0 |
| celsius-m7010-firmware | — | 1.12.0 |
| celsius-m7010power-firmware | — | 1.12.0 |
| celsius-m7010x-firmware | — | 1.06.0 |
| celsius-m7010xpower-firmware | — | 1.06.0 |
| celsius-r970-firmware | — | 1.14.0 |
| celsius-r970b-firmware | — | 1.14.0 |
| celsius-r970bpower-firmware | — | 1.14.0 |
| celsius-w5010-firmware | — | 1.64.0 |
| celsius-w5010\/l-firmware | — | 1.64.0 |
| celsius-w5011-firmware | — | 1.31.0 |
| celsius-w5012-firmware | — | 3.08.0 |
| celsius-w5012-ll-firmware | — | 3.08.0 |
| celsius-w570-firmware | — | 1.35.0 |
| celsius-w570power-firmware | — | 1.35.0 |
| celsius-w570power\+-firmware | — | 1.35.0 |
| celsius-w580-firmware | — | 1.38.0 |
| celsius-w580power-firmware | — | 1.38.0 |
| celsius-w580power\+-firmware | — | 1.38.0 |
| esprimo-d556\/2-firmware | — | 1.35.0 |
| esprimo-d6011-firmware | — | 1.31.0 |
| esprimo-d6012-firmware | — | 3.08.0 |
| esprimo-d7010-firmware | — | 1.64.0 |
| esprimo-d7010\/8-firmware | — | 1.64.0 |
| esprimo-d7011-firmware | — | 1.31.0 |
| esprimo-d7012-firmware | — | 3.08.0 |
| esprimo-d7013-firmware | — | 3.08.0 |
| esprimo-d738-firmware | — | 1.38.0 |
| esprimo-d757-firmware | — | 1.35.0 |
| esprimo-d9010-firmware | — | 1.64.0 |
| esprimo-d9011-firmware | — | 1.31.0 |
| esprimo-d9012-firmware | — | 3.08.0 |
| esprimo-d9013-firmware | — | 3.08.0 |
| esprimo-d957-firmware | — | 1.35.0 |
| esprimo-d957\/e9x\+-firmware | — | 1.35.0 |
| esprimo-d958-firmware | — | 1.38.0 |
| esprimo-g5010-firmware | — | 1.45.0 |
| esprimo-g5011-firmware | — | 1.27.0 |
| esprimo-g558-firmware | — | 1.38.0 |
| esprimo-g6012-firmware | — | 3.08.0 |
| esprimo-g9010-firmware | — | 1.45.0 |
| esprimo-g9012-firmware | — | 3.08.0 |
| esprimo-g9013-firmware | — | 3.08.0 |
| esprimo-k5010\/24-firmware | — | 1.64.0 |
| esprimo-k557\/24-firmware | — | 1.18.0 |
| esprimo-k558\/24-firmware | — | 1.38.0 |
| esprimo-p5010-firmware | — | 1.64.0 |
| esprimo-p5011-firmware | — | 1.31.0 |
| esprimo-p557-firmware | — | 1.35.0 |
| esprimo-p558\/power-firmware | — | 1.38.0 |
| esprimo-p6012-firmware | — | 3.08.0 |
| esprimo-p7010-firmware | — | 1.64.0 |
| esprimo-p7011-firmware | — | 1.31.0 |
| esprimo-p7012-firmware | — | 3.08.0 |
| esprimo-p7013-firmware | — | 3.08.0 |
| esprimo-p757-firmware | — | 1.35.0 |
| esprimo-p758-firmware | — | 1.38.0 |
| esprimo-p9010-firmware | — | 1.64.0 |
| esprimo-p9011-firmware | — | 1.31.0 |
| esprimo-p9012-firmware | — | 3.08.0 |
| esprimo-p9013-firmware | — | 3.08.0 |
| esprimo-p957-firmware | — | 1.35.0 |
| esprimo-p958-firmware | — | 1.38.0 |
| esprimo-p958\/power-firmware | — | 1.38.0 |
| esprimo-p9910-firmware | — | 1.64.0 |
| esprimo-q556\/2-firmware | — | 1.35.0 |
| esprimo-q556\/2\/d-firmware | — | 1.35.0 |
| esprimo-q558-firmware | — | 1.38.0 |
| esprimo-q7010-firmware | — | 2.20.0 |
| esprimo-q957-firmware | — | 1.35.0 |
| esprimo-q957\/mre-firmware | — | 1.35.0 |
| esprimo-q958-firmware | — | 1.38.0 |
| esprimo-q958\/mre-firmware | — | 1.38.0 |
| insydeh2o | 5.6 | 5.6.05.60.47 |
| lifebook-a3510-firmware | — | 1.16 |
| lifebook-a3511-firmware | — | — |
| lifebook-e4411-firmware | — | 2.40 |
| lifebook-e4511-firmware | — | 2.40 |
| lifebook-e5410-firmware | — | 2.33 |
| lifebook-e5411-firmware | — | 2.40 |
| lifebook-e5412-firmware | — | 2.33 |
| lifebook-e5412\/mtc-firmware | — | 2.33 |
| lifebook-e5413-firmware | — | 2.15 |
| lifebook-e549-firmware | — | 2.25 |
| lifebook-e5510-firmware | — | 2.33 |
| lifebook-e5511-firmware | — | 2.40 |
| lifebook-e5512-firmware | — | 2.33 |
| lifebook-e5513-firmware | — | 2.15 |
| lifebook-e559-firmware | — | 2.25 |
| lifebook-e736-firmware | — | — |
| lifebook-e736-vpro-firmware | — | — |
| lifebook-e746-firmware | — | — |
| lifebook-e746-vpro-firmware | — | — |
| lifebook-t939-firmware | — | 2.20 |
| lifebook-u5313x-firmware | — | 2.08 |
| lifebook-u729-firmware | — | 2.30 |
| lifebook-u729x-firmware | — | 2.21 |
| lifebook-u7310-firmware | — | 2.29 |
| lifebook-u7311-firmware | — | 2.44 |
| lifebook-u7312-firmware | — | 2.33 |
| lifebook-u7313-firmware | — | 2.15 |
| lifebook-u7410-firmware | — | 2.29 |
| lifebook-u7411-firmware | — | 2.44 |
| lifebook-u7412-firmware | — | 2.33 |
| lifebook-u7413-firmware | — | 2.15 |
| lifebook-u749-firmware | — | 2.30 |
| lifebook-u7510-firmware | — | 2.29 |
| lifebook-u7511-firmware | — | 2.44 |
| lifebook-u7512-firmware | — | 2.33 |
| lifebook-u759-firmware | — | 2.30 |
| lifebook-u7613-firmware | — | 2.15 |
| lifebook-u9310-firmware | — | 2.27 |
| lifebook-u9310x-firmware | — | 2.27 |
| lifebook-u9311-firmware | — | 2.53 |
| lifebook-u9312-firmware | — | 2.31 |
| lifebook-u9312x-firmware | — | 2.21 |
| lifebook-u9313x-firmware | — | 2.12 |
| lifebook-u939-firmware | — | 2.23 |
| lifebook-u939x-firmware | — | 2.26 |
| lifebook-u9413-firmware | — | 2.12 |
| primequest-3800b-firmware | — | 2.23.0 |
| primequest-3800b2-firmware | — | 1.67.0 |
| primequest-3800e-firmware | — | pa25021 |
| primequest-3800e2-firmware | — | pb25021 |
| primequest-4400e-firmware | — | fa17001 |
| primergy-bx2560-m2-firmware | — | 1.21.0 |
| primergy-bx2580-m2-firmware | — | 1.21.0 |
| primergy-cx2550-m4-firmware | — | 1.51.0 |
| primergy-cx2550-m5-firmware | — | 1.25.0 |
| primergy-cx2550-m6-firmware | — | 1.34.0 |
| primergy-cx2550-m7-firmware | — | 2.6.0 |
| primergy-cx2560-m4-firmware | — | 1..51.0 |
| primergy-cx2560-m5-firmware | — | 1.34.0 |
| primergy-cx2560-m6-firmware | — | 1.34.0 |
| primergy-cx2560-m7-firmware | — | 2.2.0 |
| primergy-cx2570-m4-firmware | — | 1.51.0 |
| primergy-cx2570-m5-firmware | — | 1.25.0 |
| primergy-gx2460-m1-firmware | — | 7.11.3 |
| primergy-gx2560-m7-firmware | — | 2.6.0 |
| primergy-gx2570-m6-firmware | — | 1.9 |
| primergy-rx1330-m3-firmware | — | 1.39.0 |
| primergy-rx1330-m4-firmware | — | 1.30.0 |
| primergy-rx1330-m5-firmware | — | 1.50.0 |
| primergy-rx1440-m2-firmware | — | 1.6.0 |
| primergy-rx2450-m1-firmware | — | 3.0 |
| primergy-rx2450-m2-firmware | — | 1.6.0 |
| primergy-rx2520-m4-firmware | — | 1.63.0 |
| primergy-rx2520-m5-firmware | — | 1.41.0 |
| primergy-rx2530-m4-firmware | — | 1.63.0 |
| primergy-rx2530-m5-firmware | — | 1.41.0 |
| primergy-rx2530-m6-firmware | — | 1.28.0 |
| primergy-rx2530-m7-firmware | — | 2.8.0 |
| primergy-rx2540-m4-firmware | — | 1.63.0 |
| primergy-rx2540-m5-firmware | — | 1.41.0 |
| primergy-rx2540-m6-firmware | — | 1.28.0 |
| primergy-rx2540-m7-firmware | — | 2.8.0 |
| primergy-rx4770-m3-firmware | — | 1.27.0 |
| primergy-rx4770-m4-firmware | — | 1.63.0 |
| primergy-rx4770-m5-firmware | — | 1.41.0 |
| primergy-rx4770-m6-firmware | — | 1.23.0 |
| primergy-rx4770-m7-firmware | — | 2.8.0 |
| primergy-rx8770-m7-firmware | — | 2.8.0 |
| primergy-tx1310-m3-firmware | — | 1.39.0 |
| primergy-tx1310-m5-firmware | — | 1.50.0 |
| primergy-tx1320-m3-firmware | — | 1.39.0 |
| primergy-tx1320-m4-firmware | — | 1.30.0 |
| primergy-tx1320-m5-firmware | — | 1.50.0 |
| primergy-tx1330-m3-firmware | — | 1.39.0 |
| primergy-tx1330-m4-firmware | — | 1.30.0 |
| primergy-tx1330-m5-firmware | — | 1.50.0 |
| primergy-tx2550-m4-firmware | — | 1.63.0 |
| primergy-tx2550-m5-firmware | — | 1.41.0 |
| primergy-tx2550-m7-firmware | — | 2.5.0 |
| stylistic-q5010-firmware | — | 1.38 |
| stylistic-q509-firmware | — | 1.37 |
| stylistic-q7310-firmware | — | 2.27 |
| stylistic-q7311-firmware | — | 2.36 |
| stylistic-q7312-firmware | — | 2.17 |
| stylistic-q739-firmware | — | 2.21 |
References
Exploit https://binarly.io/posts/finding_logofail_the_dangers_of_image_parsing_during_system_boot/index.html
Third Party Advisory https://security.netapp.com/advisory/ntap-20240105-0002/
Vendor Advisory https://www.insyde.com/security-pledge
Vendor Advisory https://www.insyde.com/security-pledge/SA-2023053
Third Party Advisory https://www.kb.cert.org/vuls/id/811862
Exploit https://binarly.io/posts/finding_logofail_the_dangers_of_image_parsing_during_system_boot/index.html
Third Party Advisory https://security.netapp.com/advisory/ntap-20240105-0002/
Vendor Advisory https://www.insyde.com/security-pledge
Vendor Advisory https://www.insyde.com/security-pledge/SA-2023053
Third Party Advisory https://www.kb.cert.org/vuls/id/811862
Exploit Protection
Help block exploit attempts
BotEraser is designed to detect and help reduce malicious bot traffic that may target known vulnerabilities on your site.
Try BotEraser Free →No credit card required · Results in minutes
ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.
