PT-2022-11868 · Insyde · Insydeh2O

Published 2022-02-02 · Updated 2022-03-29 · CVE-2021-43522

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions InsydeH2O kernel versions 5.1 through 2021-11-08 InsydeH2O kernel versions 5.2 through 2021-11-08 InsydeH2O kernel versions 5.3 through 2021-11-08

Description An issue in InsydeH2O allows an attacker to write fixed or predictable data to SMRAM due to a StorageSecurityCommandDxe SMM memory corruption. This could lead to escalating privileges to SMM.

Recommendations For InsydeH2O kernel versions 5.1 through 2021-11-08, consider restricting access to the StorageSecurityCommandDxe module to minimize the risk of exploitation. For InsydeH2O kernel versions 5.2 through 2021-11-08, consider restricting access to the StorageSecurityCommandDxe module to minimize the risk of exploitation. For InsydeH2O kernel versions 5.3 through 2021-11-08, consider restricting access to the StorageSecurityCommandDxe module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2021-43522

Affected Products

Insydeh2O

References · 6

• https://insyde.com/security-pledge · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-43522 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43522 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf · Note
• https://security.netapp.com/advisory/ntap-20220216-0003 · Note
• https://kb.cert.org/vuls/id/796611 · Note