LogoFAIL out-of-bounds write in Insyde InsydeH2O BmpDecoderDxe

CVE-2023-40238 is a LogoFAIL vulnerability in the BMP image parser used by Insyde InsydeH2O firmware on certain Lenovo devices. The flaw is in the BmpDecoderDxe DXE driver, specifically in BMP RLE4/RLE8 decompression handling. According to the provided content, crafted BMP logo files can trigger an integer signedness error involving PixelHeight and PixelWidth, causing incorrect pointer arithmetic during image decoding. In the reported RLE8 case, DecodeRLE8 computes a destination pointer based on PixelWidth * (PixelHeight - i - 1); if PixelHeight is attacker-controlled and set to 0, the computed BltEntry pointer underflows and points below the intended BltOutput buffer. Subsequent decode writes then copy attacker-influenced data to a controllable memory address during the UEFI DXE phase. The issue affects Insyde InsydeH2O kernel 5.2 before 05.28.47, 5.3 before 05.37.47, 5.4 before 05.45.47, 5.5 before 05.53.47, and 5.6 before 05.60.47 for certain Lenovo devices.