PT-2022-11873 · Insyde · Insydeh2O

Published 2022-02-03 · Updated 2022-03-29 · CVE-2021-43615

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Insyde InsydeH2O with kernel versions 5.1 through 05.16.23 Insyde InsydeH2O with kernel versions 5.2 through 05.26.23 Insyde InsydeH2O with kernel versions 5.3 through 05.35.23 Insyde InsydeH2O with kernel versions 5.4 through 05.43.22 Insyde InsydeH2O with kernel versions 5.5 through 05.51.22

Description An SMM memory corruption issue allows an attacker to write fixed or predictable data to SMRAM, potentially leading to escalating privileges to SMM. This could be exploited by an attacker to hijack the execution flow of code running in System Management Mode.

Recommendations For kernel version 5.1 through 05.16.23, update to a version after 05.16.23 to resolve the issue. For kernel version 5.2 through 05.26.23, update to a version after 05.26.23 to resolve the issue. For kernel version 5.3 through 05.35.23, update to a version after 05.35.23 to resolve the issue. For kernel version 5.4 through 05.43.22, update to a version after 05.43.22 to resolve the issue. For kernel version 5.5 through 05.51.22, update to a version after 05.51.22 to resolve the issue.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2021-43615

Affected Products

Insydeh2O

References · 9

• https://insyde.com/security-pledge · Vendor Advisory
• https://insyde.com/security-pledge/SA-2022013 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-43615 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43615 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf · Note
• https://security.netapp.com/advisory/ntap-20220216-0010 · Note
• https://t.me/cibsecurity/36736 · Telegram Post
• https://t.me/cvenotify/26476 · Telegram Post
• https://kb.cert.org/vuls/id/796611 · Note