PT-2022-11497 · Insyde · Insydeh2O

Published 2022-02-03 · Updated 2022-03-29 · CVE-2021-41841

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Insyde InsydeH2O kernel versions 5.0 through 5.5

Description An issue in AhciBusDxe allows an attacker to access the System Management Mode and execute arbitrary code due to the inclusion of functionality from an untrusted control sphere. This is caused by an SMM callout. Additionally, a vulnerability exists in the SMM branch that registers a SWSMI handler, which does not sufficiently check or validate allocated table variables EFI BOOT SERVICES and EFI RUNTIME SERVICES, allowing an attacker to overwrite the address location of the LocateHandleBuffer function to execute arbitrary code.

Recommendations For kernel versions 5.0 through 5.5, consider disabling the SMM callout in AhciBusDxe as a temporary workaround until a patch is available. Restrict access to the SWSMI handler to minimize the risk of exploitation. Avoid using the EFI BOOT SERVICES and EFI RUNTIME SERVICES variables in the affected SMM branch until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-829

Related Identifiers

CVE-2021-41841

Affected Products

Insydeh2O

References · 10

• https://insyde.com/security-pledge · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41841 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41841 · Vendor Advisory
• https://insyde.com/security-pledge/SA-2022019 · Vendor Advisory
• https://t.me/cvenotify/26478 · Telegram Post
• https://t.me/cvenotify/26963 · Telegram Post
• https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf · Note
• https://t.me/cibsecurity/36754 · Telegram Post
• https://kb.cert.org/vuls/id/796611 · Note
• https://security.netapp.com/advisory/ntap-20220217-0012 · Note