PT-2022-11498 · Insyde · Insydeh2O

Published 2022-01-05 · Updated 2022-03-01 · CVE-2021-41842

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Insyde InsydeH2O kernel versions 5.0 through 5.0 before 05.08.46 Insyde InsydeH2O kernel versions 5.1 through 5.1 before 05.16.46 Insyde InsydeH2O kernel versions 5.2 through 5.2 before 05.26.46 Insyde InsydeH2O kernel versions 5.3 through 5.3 before 05.35.46 Insyde InsydeH2O kernel versions 5.4 through 5.4 before 05.43.46 Insyde InsydeH2O kernel versions 5.5 through 5.5 before 05.51.45

Description An issue was discovered in AtaLegacySmm. Code execution can occur because the SMI handler lacks a CommBuffer check.

Recommendations For kernel version 5.0 before 05.08.46, update to version 05.08.46 or later. For kernel version 5.1 before 05.16.46, update to version 05.16.46 or later. For kernel version 5.2 before 05.26.46, update to version 05.26.46 or later. For kernel version 5.3 before 05.35.46, update to version 05.35.46 or later. For kernel version 5.4 before 05.43.46, update to version 05.43.46 or later. For kernel version 5.5 before 05.51.45, update to version 05.51.45 or later.

Fix

Related Identifiers

CVE-2021-41842

Affected Products

Insydeh2O

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-41842 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41842 · Vendor Advisory
• https://insyde.com/security-pledge · Vendor Advisory
• https://t.me/cvenotify/25002 · Telegram Post
• https://security.netapp.com/advisory/ntap-20220223-0002 · Note