CVE-2021-33627

CVE-2021-33627 affects Insyde InsydeH2O 5.x (FwBlockServiceSmm). The SMM Communicate() handling does not validate the buffer address, enabling use of SMRAM, MMIO, or OS kernel addresses. Impact: local attacker could escalate to SMM execution and potentially compromise SMRAM or firmware. Fixed in ...

CVE-2021-42060

CVE-2021-42060 concerns Insyde InsydeH2O kernel SMM handling. An Int15ServiceSmm SMM callout could hijack execution flow in System Management Mode, enabling privilege escalation to SMM. Affected firmware: InsydeH2O Kernel 5.0–05.08.41, 5.1–05.16.41, 5.2 before 05.23.22, 5.3 before 05.32.22. Remed...

CVE-2021-42060

An issue was discovered in Insyde InsydeH2O Kernel 5.0 through 05.08.41, Kernel 5.1 through 05.16.41, Kernel 5.2 before 05.23.22, and Kernel 5.3 before 05.32.22. An Int15ServiceSmm SMM callout vulnerability allows an attacker to hijack execution flow of code running in System Management Mode...

CVE-2021-41837

CVE-2021-41837 affects InsydeH2O’s AhciBusDxe driver in kernel versions 5.0–5.5. The flaw stems from an Untrusted Pointer Dereference that can corrupt SMM memory (SMRAM) and enable a local attacker to escalate privileges to System Management Mode. Public documentation (NVD/Tenable, Binarly/CERT a...

CVE-2021-41837

An issue was discovered in AhciBusDxe in the kernel 5.0 through 5.5 in Insyde InsydeH2O. Because of an Untrusted Pointer Dereference that causes SMM memory corruption, an attacker may be able to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to...

CVE-2021-41840

CVE-2021-41840 affects InsydeH2O-based firmware, specifically the NvmExpressDxe driver in kernel 5.0–5.5. A System Management Mode (SMM) callout flaw allows an attacker to access SMM and execute arbitrary code due to untrusted control-sphere handling. The vulnerability can enable local privilege ...

CVE-2021-41840

An issue was discovered in NvmExpressDxe in the kernel 5.0 through 5.5 in Insyde InsydeH2O. There is an SMM callout that allows an attacker to access the System Management Mode and execute arbitrary code. This occurs because of Inclusion of Functionality from an Untrusted Control Sphere...

CVE-2022-24030

CVE-2022-24030 affects InsydeH2O’s AhciBusDxe driver. The issue is an SMM memory corruption vulnerability in kernel 5.1–5.5 that allows writing fixed or predictable data to SMRAM, enabling privilege escalation to System Management Mode. Affected kernel/workload context is local with no user inter...

CVE-2020-5953

A vulnerability exists in System Management Interrupt SWSMI handler of InsydeH2O UEFI Firmware code located in SWSMI handler that dereferences gRT EFIRUNTIMESERVICES pointer to call a GetVariable service, which is located outside of SMRAM. This can result in code execution in SMM escalating...

CVE-2020-5953

A vulnerability exists in System Management Interrupt SWSMI handler of InsydeH2O UEFI Firmware code located in SWSMI handler that dereferences gRT EFIRUNTIMESERVICES pointer to call a GetVariable service, which is located outside of SMRAM. This can result in code execution in SMM escalating...

Code injection

A vulnerability exists in System Management Interrupt SWSMI handler of InsydeH2O UEFI Firmware code located in SWSMI handler that dereferences gRT EFIRUNTIMESERVICES pointer to call a GetVariable service, which is located outside of SMRAM. This can result in code execution in SMM escalating...

CVE-2021-42059

An issue was discovered in Insyde InsydeH2O Kernel 5.0 before 05.08.41, Kernel 5.1 before 05.16.41, Kernel 5.2 before 05.26.41, Kernel 5.3 before 05.35.41, and Kernel 5.4 before 05.42.20. A stack-based buffer overflow leads toarbitrary code execution in UEFI DisplayTypeDxe DXE driver...

CVE-2021-42059

CVE-2021-42059 affects Insyde InsydeH2O Kernel 5.0 (before 05.08.41), 5.1 (before 05.16.41), 5.2 (before 05.26.41), 5.3 (before 05.35.41), and 5.4 (before 05.42.20). The issue is a stack-based buffer overflow in the UEFI DisplayTypeDxe DXE driver that leads to arbitrary code execution. The vulner...

CVE-2021-43615

CVE-2021-43615 affects Insyde InsydeH2O HddPassword in kernel 5.x (before 05.16.23, 05.26.23, 05.35.23, 05.43.22, 05.51.22). It is a SMM memory corruption vulnerability allowing an attacker to write fixed or predictable data to SMRAM, enabling privilege escalation to System Management Mode (SMM)....

CVE-2021-43615

An issue was discovered in HddPassword in Insyde InsydeH2O with kernel 5.1 before 05.16.23, 5.2 before 05.26.23, 5.3 before 05.35.23, 5.4 before 05.43.22, and 5.5 before 05.51.22. An SMM memory corruption vulnerability allows an attacker to write fixed or predictable data to SMRAM. Exploiting thi...

CVE-2021-41841

CVE-2021-41841 affects the InsydeH2O AhciBusDxe driver. Affected kernel range is InsydeH2O 5.x. The issue is a SMM callout that can let a local attacker access System Management Mode and execute arbitrary code. Remediation per vendor/plugin details: fixed in InsydeH2O kernel releases, e.g., Kerne...

CVE-2021-41841

An issue was discovered in AhciBusDxe in the kernel 5.0 through 5.5 in Insyde InsydeH2O. There is an SMM callout that allows an attacker to access the System Management Mode and execute arbitrary code. This occurs because of Inclusion of Functionality from an Untrusted Control Sphere...

CVE-2020-5953

A vulnerability exists in System Management Interrupt SWSMI handler of InsydeH2O UEFI Firmware code located in SWSMI handler that dereferences gRT EFIRUNTIMESERVICES pointer to call a GetVariable service, which is located outside of SMRAM. This can result in code execution in SMM escalating...

CVE-2020-5953

CVE-2020-5953 affects InsydeH2O UEFI firmware, where the System Management Interrupt (SWSMI) handler dereferences EFI_RUNTIME_SERVICES (gRT) to call GetVariable outside SMRAM, enabling code execution in SMM and privilege escalation. Impact is local and architectural, as described in multiple sour...

CVE-2021-43522

An issue was discovered in Insyde InsydeH2O with kernel 5.1 through 2021-11-08, 5.2 through 2021-11-08, and 5.3 through 2021-11-08. A StorageSecurityCommandDxe SMM memory corruption vulnerability allows an attacker to write fixed or predictable data to SMRAM. Exploiting this issue could lead to...