PT-2022-11495 · Insyde · Insydeh2O

Published 2022-02-03 · Updated 2023-08-08 · CVE-2021-41839

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Insyde InsydeH2O kernel versions 5.0 through 5.5

Description An issue was discovered in NvmExpressDxe due to an Untrusted Pointer Dereference, causing SMM memory corruption. This allows an attacker to write fixed or predictable data to SMRAM, potentially leading to escalating privileges to SMM. The vulnerability exists in the SMM branch, where a SWSMI handler does not sufficiently check or validate the allocated table variable EFI BOOT SERVICES, enabling an attacker to overwrite address locations of functions like FreePool, LocateHandleBuffer, and HandleProtocol with arbitrary code. On a system call to the SWSMI handler, this arbitrary code can be triggered to execute.

Recommendations For kernel versions 5.0 through 5.5, consider disabling the SWSMI handler or restricting access to the NvmExpressDxe module to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the EFI BOOT SERVICES table variable in the affected SMM branch. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2021-41839

Affected Products

Insydeh2O

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2021-41839 · Security Note
• https://insyde.com/security-pledge · Vendor Advisory
• https://insyde.com/security-pledge/SA-2022020 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41839 · Vendor Advisory
• https://t.me/cibsecurity/36742 · Telegram Post
• https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf · Note
• https://security.netapp.com/advisory/ntap-20220217-0016 · Note
• https://t.me/cvenotify/26965 · Telegram Post
• https://kb.cert.org/vuls/id/796611 · Note