CVE-2022-23821

A security flaw in System Management Mode allows attackers to write malicious code to a computer's firmware storage, potentially taking complete control of the system. This happens because access controls in a low-level part of the operating system are not properly enforced.

An improper access control vulnerability in SMM allows an attacker with local or physical access to write arbitrary data to SPI ROM (firmware storage), potentially leading to arbitrary code execution at the highest privilege level. The vulnerability stems from insufficient validation of write operations to persistent memory regions accessible during SMM execution.