PT-2022-11496 · Insyde · Insydeh2O

Published 2022-02-03 · Updated 2022-03-29 · CVE-2021-41840

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions InsydeH2O kernel versions 5.0 through 5.5

Description An issue in NvmExpressDxe allows an attacker to access the System Management Mode and execute arbitrary code due to the inclusion of functionality from an untrusted control sphere. This vulnerability exists in the SMM branch, which registers a SWSMI handler that does not sufficiently check or validate the allocated table variable EFI BOOT SERVICES. As a result, an attacker capable of executing code in the DXE phase can exploit this issue to escalate privileges to SMM, potentially overwriting the LocateProtocol or Freepool memory address location to execute unwanted code.

Recommendations For kernel versions 5.0 through 5.5, consider disabling the SMM callout in NvmExpressDxe as a temporary workaround until a patch is available. Restrict access to the SWSMI handler to minimize the risk of exploitation. Avoid using the EFI BOOT SERVICES variable in the affected SMM branch until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2021-41840

Affected Products

Insydeh2O

References · 9

• https://insyde.com/security-pledge/SA-2022018 · Vendor Advisory
• https://insyde.com/security-pledge · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41840 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41840 · Vendor Advisory
• https://t.me/cibsecurity/36750 · Telegram Post
• https://security.netapp.com/advisory/ntap-20220217-0014 · Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf · Note
• https://kb.cert.org/vuls/id/796611 · Note
• https://t.me/cvenotify/26964 · Telegram Post