TI-2022-19101 Aliases CVE-2022-40246 GHSA-jjpm-q6jh-v8gj

Arbitrary write vulnerability in SbPei module leads to arbitrary code execution during PEI phase.

HIGH 67CWE-123Published 2022-09-20 · Updated 2025-05-28

Key facts

Attack vector: Physical
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

A potential attacker can write one byte by arbitrary address at the time of the PEI phase (only during S3 resume boot mode) and influence the subsequent boot stages. This can lead to the mitigations bypassing, physical memory contents disclosure, discovery of any secrets from any Virtual Machines (VMs) and bypassing memory isolation and confidential computing boundaries. Additionally, an attacker can build a payload which can be injected into the SMRAM memory. This issue affects: Module name: SbPei SHA256: d827182e5f9b7a9ff0b9d3e232f7cfac43b5237e2681e11f005be627a49283a9 Module GUID: c1fbd624-27ea-40d1-aa48-94c3dc5c7e0d

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.0049 42nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
AMI	Aptio	5.x	—	No fix listed	CNA

Aptio VendorAMI Affected 5.x Fixed in — No fix listed CNA

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:o:intel:nuc_m15_laptop_kit_lapbc510_firmware:0072:::::::*	0072	Vulnerable	Intel
cpe:2.3:h:intel:nuc_m15_laptop_kit_lapbc510:-:::::::*	not specified by NVD	Running on	Intel
cpe:2.3:o:intel:nuc_m15_laptop_kit_lapbc710_firmware:0072:::::::*	0072	Vulnerable	Intel
cpe:2.3:h:intel:nuc_m15_laptop_kit_lapbc710:-:::::::*	not specified by NVD	Running on	Intel

cpe:2.3:o:intel:nuc_m15_laptop_kit_lapbc510_firmware:0072:*:*:*:*:*:*:* Versions 0072 Vulnerable ·Intel
cpe:2.3:h:intel:nuc_m15_laptop_kit_lapbc510:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel
cpe:2.3:o:intel:nuc_m15_laptop_kit_lapbc710_firmware:0072:*:*:*:*:*:*:* Versions 0072 Vulnerable ·Intel
cpe:2.3:h:intel:nuc_m15_laptop_kit_lapbc710:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Intel

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2022-40246
2026-10-03 Alias added: GHSA-jjpm-q6jh-v8gj

References

Exploit 1

https://www.binarly.io/advisories/BRLY-2022-014

Advisory 1

https://www.ami.com/security-center/

TI-2024-36205 Redfish Authentication Bypass KEVCVSS 4.0CRITICAL 10.0
TI-2022-19108 The arbitrary write vulnerability in S3Resume2Pei leads to arbitrary code execution during PEI phase. CVSS 3.1HIGH 8.2
TI-2022-19103 Stack overflow vulnerability in SMI handler on SmmSmbiosElog. CVSS 3.1HIGH 8.8
TI-2022-19107 SMM memory corruption vulnerability in OverClockSmiHandler SMM driver CVSS 3.1HIGH 8.2
TI-2022-10117 Stack-based buffer overflow in AMI Aptio CVSS 3.1HIGH 8.2
TI-2022-19100 MegaRAC Default Credentials Vulnerability CVSS 3.1CRITICAL 9.8

See all 68 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences