PT-2021-20235 · Smm · Smm

Published 2021-10-01 · Updated 2022-04-24 · CVE-2021-33626

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: SMM (System Management Mode) (affected versions not specified)

Description: A vulnerability exists in the SMM branch that registers a SWSMI handler, which does not sufficiently check or validate the allocated buffer pointer (QWORD values for CommBuffer). This can be used by an attacker to corrupt data in SMRAM memory and potentially lead to arbitrary code execution.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-829

Related Identifiers

CVE-2021-33626

Affected Products

Smm

References · 7

• https://insyde.com/security-pledge · Vendor Advisory
• https://insyde.com/security-pledge/SA-2021001 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-33626 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33626 · Security Note
• https://kb.cert.org/vuls/id/796611 · Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf · Note
• https://security.netapp.com/advisory/ntap-20220216-0006 · Note