PT-2022-11494 · Insyde · Insydeh2O

Published 2022-02-03 · Updated 2022-03-01 · CVE-2021-41838

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions InsydeH2O kernel versions 5.0 through 5.5

Description The issue allows an attacker to access the System Management Mode and execute arbitrary code due to a Numeric Range Comparison Without a Minimum Check in the SdHostDriver. This vulnerability can lead to escalation of privileges reserved only for SMM. An unsafe pointer ptr in the SMM branch that registers a SWSMI handler can be used to read, write, or manipulate data in the SMRAM.

Recommendations For kernel versions 5.0 through 5.5, consider disabling the SMM callout in the SdHostDriver as a temporary workaround until a patch is available. Restrict access to the SWSMI handler to minimize the risk of exploitation. Avoid using the ptr pointer in the affected SMM branch until the issue is resolved.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2021-41838

Affected Products

Insydeh2O

References · 8

• https://insyde.com/security-pledge · Vendor Advisory
• https://insyde.com/security-pledge/SA-2022023 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41838 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41838 · Vendor Advisory
• https://t.me/cibsecurity/36739 · Telegram Post
• https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf · Note
• https://security.netapp.com/advisory/ntap-20220222-0001 · Note
• https://kb.cert.org/vuls/id/796611 · Note