CVE-2022-29264: 
Linux Debian vulnerability analysis and mitigation

A security vulnerability (CVE-2022-29264) was discovered in coreboot versions 4.13 through 4.16, affecting the System Management Mode (SMM) functionality. The vulnerability was identified and disclosed on April 25, 2022, potentially allowing arbitrary code execution in SMM on Application Processors (APs) (NVD CVE, MITRE CVE).

The vulnerability received a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The issue stems from the SMM module loader's limitations in handling systems with more than 32 CPU threads, where the state save area begins to encroach upon the SMI handling code. This can result in system hangs and reboots (Coreboot Commit).

The vulnerability could allow attackers to execute arbitrary code in System Management Mode, which operates at the highest privilege level of the processor. This could potentially lead to complete system compromise, as SMM has full access to the system's hardware and can bypass operating system-level security controls (NVD CVE).

The vulnerability was addressed in coreboot version 4.17 through the introduction of SMM module loader version 2, which extends beyond the 64K segment to accommodate additional CPUs and is theoretically limited only by SMRAM space rather than the 64K boundary (Coreboot Commit).