Vulnerability Name:

CVE-2021-33626 (CCN-210504)

Assigned:2021-06-15
Published:2021-06-15
Updated:2022-04-24
Summary:A vulnerability exists in SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pointer(QWORD values for CommBuffer). This can be used by an attacker to corrupt data in SMRAM memory and even lead to arbitrary code execution.
CVSS v3 Severity:7.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
6.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
7.2 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N)
6.3 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): High
Privileges Required (PR): High
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): None
CVSS v2 Severity:4.6 Medium (CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
5.5 Medium (CCN CVSS v2 Vector: AV:L/AC:H/Au:S/C:C/I:C/A:N)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): High
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): None
Vulnerability Type:CWE-829
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2021-33626

Source: CONFIRM
Type: Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf

Source: XF
Type: UNKNOWN
insydeh2o-cve202133626-priv-esc(210504)

Source: CONFIRM
Type: Third Party Advisory
https://security.netapp.com/advisory/ntap-20220216-0006/

Source: MISC
Type: Vendor Advisory
https://www.insyde.com/security-pledge

Source: CCN
Type: INSYDE-SA-2021001
Insyde Software Security Advisory

Source: MISC
Type: Vendor Advisory
https://www.insyde.com/security-pledge/SA-2021001

Vulnerable Configuration:Configuration 1:
  • cpe:/o:insyde:insydeh2o:*:*:*:*:*:*:*:* (Version >= 5.3 and < 5.34.44)

    • Configuration 2:
  • cpe:/o:insyde:insydeh2o:*:*:*:*:*:*:*:* (Version >= 5.2 and < 5.25.44)

    • Configuration 3:
  • cpe:/o:insyde:insydeh2o:*:*:*:*:*:*:*:* (Version >= 5.1 and < 5.16.25)

    • Configuration 4:
  • cpe:/o:insyde:insydeh2o:*:*:*:*:*:*:*:* (Version >= 5.4 and < 5.42.44)

    • Configuration 5:
  • cpe:/o:insyde:insydeh2o:*:*:*:*:*:*:*:* (Version >= 5.3 and < 5.35.25)

    • Configuration 6:
  • cpe:/o:insyde:insydeh2o:*:*:*:*:*:*:*:* (Version >= 5.2 and < 5.26.25)

    • Configuration 7:
  • cpe:/o:insyde:insydeh2o:*:*:*:*:*:*:*:* (Version >= 5.4 and < 5.43.25)

    • Configuration 8:
  • cpe:/o:siemens:ruggedcom_apr1808_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:ruggedcom_apr1808:-:*:*:*:*:*:*:*

    • Configuration 9:
  • cpe:/o:siemens:simatic_field_pg_m5_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:simatic_field_pg_m5:-:*:*:*:*:*:*:*

    • Configuration 10:
  • cpe:/o:siemens:simatic_field_pg_m6_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:simatic_field_pg_m6:-:*:*:*:*:*:*:*

    • Configuration 11:
  • cpe:/o:siemens:simatic_ipc127e_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:simatic_ipc127e:-:*:*:*:*:*:*:*

    • Configuration 12:
  • cpe:/o:siemens:simatic_ipc227g_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:simatic_ipc227g:-:*:*:*:*:*:*:*

    • Configuration 13:
  • cpe:/o:siemens:simatic_ipc277g_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:simatic_ipc277g:-:*:*:*:*:*:*:*

    • Configuration 14:
  • cpe:/o:siemens:simatic_ipc327g_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:simatic_ipc327g:-:*:*:*:*:*:*:*

    • Configuration 15:
  • cpe:/o:siemens:simatic_ipc377g_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:simatic_ipc377g:-:*:*:*:*:*:*:*

    • Configuration 16:
  • cpe:/o:siemens:simatic_ipc427e_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:simatic_ipc427e:-:*:*:*:*:*:*:*

    • Configuration 17:
  • cpe:/o:siemens:simatic_ipc477e_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:simatic_ipc477e:-:*:*:*:*:*:*:*

    • Configuration 18:
  • cpe:/o:siemens:simatic_ipc477e_pro_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:simatic_ipc477e_pro:-:*:*:*:*:*:*:*

    • Configuration 19:
  • cpe:/o:siemens:simatic_ipc627e_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:simatic_ipc627e:-:*:*:*:*:*:*:*

    • Configuration 20:
  • cpe:/o:siemens:simatic_ipc647e_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:simatic_ipc647e:-:*:*:*:*:*:*:*

    • Configuration 21:
  • cpe:/o:siemens:simatic_ipc677e_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:simatic_ipc677e:-:*:*:*:*:*:*:*

    • Configuration 22:
  • cpe:/o:siemens:simatic_ipc847e_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:simatic_ipc847e:-:*:*:*:*:*:*:*

    • Configuration 23:
  • cpe:/o:siemens:simatic_itp1000_firmware:-:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:simatic_itp1000:-:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:insyde:insydeh2o:5.1:*:*:*:*:*:*:*
  • OR cpe:/a:insyde:insydeh2o:5.2:*:*:*:*:*:*:*
  • OR cpe:/a:insyde:insydeh2o:5.3:*:*:*:*:*:*:*
  • OR cpe:/a:insyde:insydeh2o:5.4:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    insyde insydeh2o *
    insyde insydeh2o *
    insyde insydeh2o *
    insyde insydeh2o *
    insyde insydeh2o *
    insyde insydeh2o *
    insyde insydeh2o *
    siemens ruggedcom apr1808 firmware -
    siemens ruggedcom apr1808 -
    siemens simatic field pg m5 firmware -
    siemens simatic field pg m5 -
    siemens simatic field pg m6 firmware -
    siemens simatic field pg m6 -
    siemens simatic ipc127e firmware -
    siemens simatic ipc127e -
    siemens simatic ipc227g firmware -
    siemens simatic ipc227g -
    siemens simatic ipc277g firmware -
    siemens simatic ipc277g -
    siemens simatic ipc327g firmware -
    siemens simatic ipc327g -
    siemens simatic ipc377g firmware -
    siemens simatic ipc377g -
    siemens simatic ipc427e firmware -
    siemens simatic ipc427e -
    siemens simatic ipc477e firmware -
    siemens simatic ipc477e -
    siemens simatic ipc477e pro firmware -
    siemens simatic ipc477e pro -
    siemens simatic ipc627e firmware -
    siemens simatic ipc627e -
    siemens simatic ipc647e firmware -
    siemens simatic ipc647e -
    siemens simatic ipc677e firmware -
    siemens simatic ipc677e -
    siemens simatic ipc847e firmware -
    siemens simatic ipc847e -
    siemens simatic itp1000 firmware -
    siemens simatic itp1000 -
    insyde insydeh2o 5.1
    insyde insydeh2o 5.2
    insyde insydeh2o 5.3
    insyde insydeh2o 5.4