PT-2022-10273 · Insyde · Insydeh2O

Published 2022-02-03 · Updated 2022-04-12 · CVE-2021-33625

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Insyde InsydeH2O Kernel 5.x

Description An issue was discovered in Insyde InsydeH2O, affecting HddPassword, where software SMI services using the Communicate() function of the EFI SMM COMMUNICATION PROTOCOL do not validate the buffer address, allowing the use of SMRAM, MMIO, or OS kernel addresses.

Recommendations For Insyde InsydeH2O Kernel 5.x, as a temporary workaround, consider restricting the use of the Communicate() function within the EFI SMM COMMUNICATION PROTOCOL until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2021-33625

Affected Products

Insydeh2O

References · 8

• https://insyde.com/security-pledge/SA-2022014 · Vendor Advisory
• https://insyde.com/security-pledge · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-33625 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33625 · Security Note
• https://security.netapp.com/advisory/ntap-20220222-0004 · Note
• https://t.me/cvenotify/26528 · Telegram Post
• https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf · Note
• https://kb.cert.org/vuls/id/796611 · Note