PT-2022-11823 · Insyde · Insydeh2O

Published 2022-02-03 · Updated 2022-03-29 · CVE-2021-43323

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Insyde InsydeH2O with kernel 5.5 before 05.51.45 Insyde InsydeH2O with kernel 5.4 before 05.43.45 Insyde InsydeH2O with kernel 5.3 before 05.35.45 Insyde InsydeH2O with kernel 5.2 before 05.26.45 Insyde InsydeH2O with kernel 5.1 before 05.16.45 Insyde InsydeH2O with kernel 5.0 before 05.08.45

Description An issue was discovered in UsbCoreDxe that allows an attacker to hijack execution flow of code running in System Management Mode. This could lead to escalating privileges to SMM.

Recommendations For Insyde InsydeH2O with kernel 5.5 before 05.51.45, update to a version after 05.51.45. For Insyde InsydeH2O with kernel 5.4 before 05.43.45, update to a version after 05.43.45. For Insyde InsydeH2O with kernel 5.3 before 05.35.45, update to a version after 05.35.45. For Insyde InsydeH2O with kernel 5.2 before 05.26.45, update to a version after 05.26.45. For Insyde InsydeH2O with kernel 5.1 before 05.16.45, update to a version after 05.16.45. For Insyde InsydeH2O with kernel 5.0 before 05.08.45, update to a version after 05.08.45.

Fix

Related Identifiers

CVE-2021-43323

Affected Products

Insydeh2O

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2021-43323 · Security Note
• https://osv.dev/vulnerability/CVE-2021-43323 · Vendor Advisory
• https://insyde.com/security-pledge · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf · Note
• https://t.me/cibsecurity/36753 · Telegram Post
• https://t.me/cvenotify/26961 · Telegram Post
• https://security.netapp.com/advisory/ntap-20220217-0013 · Note
• https://kb.cert.org/vuls/id/796611 · Note