PT-2022-11543 · Insyde · Insydeh2O

Published 2022-02-03 · Updated 2022-03-29 · CVE-2021-42113

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Insyde InsydeH2O with Kernel 5.1 before 05.14.28 Insyde InsydeH2O with Kernel 5.2 before 05.24.28 Insyde InsydeH2O with Kernel 5.3 before 05.32.25

Description An issue was discovered in StorageSecurityCommandDxe, allowing an attacker to hijack execution flow of code running in System Management Mode. This could lead to escalating privileges to SMM.

Recommendations For Insyde InsydeH2O with Kernel 5.1 before 05.14.28, update to a version after 05.14.28 to resolve the issue. For Insyde InsydeH2O with Kernel 5.2 before 05.24.28, update to a version after 05.24.28 to resolve the issue. For Insyde InsydeH2O with Kernel 5.3 before 05.32.25, update to a version after 05.32.25 to resolve the issue.

Fix

Related Identifiers

CVE-2021-42113

Affected Products

Insydeh2O

References · 9

• https://insyde.com/security-pledge/SA-2022008 · Vendor Advisory
• https://insyde.com/security-pledge · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-42113 · Security Note
• https://osv.dev/vulnerability/CVE-2021-42113 · Vendor Advisory
• https://t.me/cibsecurity/36746 · Telegram Post
• https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf · Note
• https://t.me/cvenotify/26890 · Telegram Post
• https://kb.cert.org/vuls/id/796611 · Note
• https://security.netapp.com/advisory/ntap-20220216-0012 · Note