PT-2024-28644 · Insyde · Insyde Ihisi

Published 2024-11-14 · Updated 2024-12-20 · CVE-2024-39707

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Insyde IHISI versions prior to kernel 5.2 version 05.29.19 Insyde IHISI versions prior to kernel 5.3 version 05.38.19 Insyde IHISI versions prior to kernel 5.4 version 05.46.19 Insyde IHISI versions prior to kernel 5.5 version 05.54.19 Insyde IHISI versions prior to kernel 5.6 version 05.61.19

Description The Insyde IHISI function 0x49 can restore factory defaults for certain UEFI variables without further authentication by default, which could lead to a possible roll-back attack in certain platforms.

Recommendations For versions prior to kernel 5.2 version 05.29.19, update to kernel 5.2 version 05.29.19 or later. For versions prior to kernel 5.3 version 05.38.19, update to kernel 5.3 version 05.38.19 or later. For versions prior to kernel 5.4 version 05.46.19, update to kernel 5.4 version 05.46.19 or later. For versions prior to kernel 5.5 version 05.54.19, update to kernel 5.5 version 05.54.19 or later. For versions prior to kernel 5.6 version 05.61.19, update to kernel 5.6 version 05.61.19 or later. As a temporary workaround, consider restricting access to the Insyde IHISI function 0x49 until a patch is available.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2024-39707

Affected Products

Insyde Ihisi

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-39707 · Security Note
• https://twitter.com/VulmonFeeds/status/1857238341453783079 · Twitter Post
• https://twitter.com/CVEnew/status/1857190684111032441 · Twitter Post
• https://t.me/cvedetector/11024 · Telegram Post
• https://insyde.com/security-pledge/SA-2024007 · Note
• https://reddit.com/r/LenovoLegion/comments/1hihrck/kwcn47ww_released · Reddit Post