PT-2022-9048 · Insyde · Insydeh2O

Published 2022-01-05 · Updated 2022-07-12 · CVE-2020-5956

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Insyde InsydeH2O kernel versions 5.1 through 05.15.10 Insyde InsydeH2O kernel versions 5.2 through 05.25.10 Insyde InsydeH2O kernel versions 5.3 through 05.34.10 Insyde InsydeH2O kernel versions 5.4 through 05.42.10

Description The issue allows untrusted external input because the software SMI handler does not verify CommBuffer.

Recommendations For kernel version 5.1, update to version 05.15.11 or later. For kernel version 5.2, update to version 05.25.11 or later. For kernel version 5.3, update to version 05.34.11 or later. For kernel version 5.4, update to version 05.42.11 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2020-5956

Affected Products

Insydeh2O

References · 5

• https://osv.dev/vulnerability/CVE-2020-5956 · Vendor Advisory
• https://insyde.com/security-pledge · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5956 · Security Note
• https://t.me/cvenotify/25000 · Telegram Post
• https://security.netapp.com/advisory/ntap-20220223-0001 · Note