PT-2022-11539 · Insyde · Insydeh2O Kernel

Published 2022-02-03 · Updated 2022-03-29 · CVE-2021-42060

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Insyde InsydeH2O Kernel versions 5.0 through 05.08.41 Insyde InsydeH2O Kernel versions 5.1 through 05.16.41 Insyde InsydeH2O Kernel versions 5.2 before 05.23.22 Insyde InsydeH2O Kernel versions 5.3 before 05.32.22

Description An issue was discovered in Insyde InsydeH2O Kernel that allows an attacker to hijack execution flow of code running in System Management Mode. Exploiting this issue could lead to escalating privileges to SMM.

Recommendations For Insyde InsydeH2O Kernel versions 5.0 through 05.08.41, update to a version after 05.08.41. For Insyde InsydeH2O Kernel versions 5.1 through 05.16.41, update to a version after 05.16.41. For Insyde InsydeH2O Kernel versions 5.2 before 05.23.22, update to version 05.23.22 or later. For Insyde InsydeH2O Kernel versions 5.3 before 05.32.22, update to version 05.32.22 or later.

Fix

Related Identifiers

CVE-2021-42060

Affected Products

Insydeh2O Kernel

References · 9

• https://insyde.com/security-pledge · Vendor Advisory
• https://insyde.com/security-pledge/SA-2022007 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-42060 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-42060 · Security Note
• https://t.me/cvenotify/26962 · Telegram Post
• https://t.me/cibsecurity/36737 · Telegram Post
• https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf · Note
• https://security.netapp.com/advisory/ntap-20220217-0015 · Note
• https://kb.cert.org/vuls/id/796611 · Note