Vulnerability Name:

CVE-2021-41838 (CCN-218661)

Assigned:2021-10-01
Published:2022-02-01
Updated:2022-03-01
Summary:An issue was discovered in SdHostDriver in the kernel 5.0 through 5.5 in Insyde InsydeH2O. There is an SMM callout that allows an attacker to access the System Management Mode and execute arbitrary code. This occurs because of a Numeric Range Comparison Without a Minimum Check.
CVSS v3 Severity:8.2 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)
7.1 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): High
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
8.2 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)
7.1 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): High
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:7.2 High (CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
6.8 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-119
Vulnerability Consequences:Gain Privileges
References:Source: MITRE
Type: CNA
CVE-2021-41838

Source: CCN
Type: US-CERT VU#796611
InsydeH2O UEFI software impacted by multiple vulnerabilities in SMM

Source: CONFIRM
Type: Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf

Source: XF
Type: UNKNOWN
insyde-cve202141838-priv-esc(218661)

Source: CONFIRM
Type: Third Party Advisory
https://security.netapp.com/advisory/ntap-20220222-0001/

Source: CCN
Type: Lenovo Security Advisory: LEN-73436
InsydeH2O UEFI System Management Mode (SMM) Vulnerabilities

Source: CCN
Type: Insyde Web site
Insyde Software Security Advisory

Source: MISC
Type: Vendor Advisory
https://www.insyde.com/security-pledge

Source: MISC
Type: Vendor Advisory
https://www.insyde.com/security-pledge/SA-2022023

Vulnerable Configuration:Configuration 1:
  • cpe:/a:insyde:insydeh2o:*:*:*:*:*:*:*:* (Version >= 5.1 and < 5.16.42)

    • Configuration 2:
  • cpe:/a:insyde:insydeh2o:*:*:*:*:*:*:*:* (Version >= 5.2 and < 5.26.42)

    • Configuration 3:
  • cpe:/a:insyde:insydeh2o:*:*:*:*:*:*:*:* (Version >= 5.3 and < 5.35.42)

    • Configuration 4:
  • cpe:/a:insyde:insydeh2o:*:*:*:*:*:*:*:* (Version >= 5.4 and < 5.43.42)

    • Configuration 5:
  • cpe:/a:insyde:insydeh2o:*:*:*:*:*:*:*:* (Version >= 5.5 and < 5.51.42)

    • Configuration 6:
  • cpe:/o:siemens:simatic_field_pg_m5_firmware:*:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:simatic_field_pg_m5:-:*:*:*:*:*:*:*

    • Configuration 7:
  • cpe:/o:siemens:simatic_field_pg_m6_firmware:*:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:simatic_field_pg_m6:-:*:*:*:*:*:*:*

    • Configuration 8:
  • cpe:/o:siemens:simatic_ipc127e_firmware:*:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:simatic_ipc127e:-:*:*:*:*:*:*:*

    • Configuration 9:
  • cpe:/o:siemens:simatic_ipc227g_firmware:*:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:simatic_ipc227g:-:*:*:*:*:*:*:*

    • Configuration 10:
  • cpe:/o:siemens:simatic_ipc277g_firmware:*:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:simatic_ipc277g:-:*:*:*:*:*:*:*

    • Configuration 11:
  • cpe:/o:siemens:simatic_ipc327g_firmware:*:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:simatic_ipc327g:-:*:*:*:*:*:*:*

    • Configuration 12:
  • cpe:/o:siemens:simatic_ipc377g_firmware:*:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:simatic_ipc377g:-:*:*:*:*:*:*:*

    • Configuration 13:
  • cpe:/o:siemens:simatic_ipc427e_firmware:*:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:simatic_ipc427e:-:*:*:*:*:*:*:*

    • Configuration 14:
  • cpe:/o:siemens:simatic_ipc477e_firmware:*:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:simatic_ipc477e:-:*:*:*:*:*:*:*

    • Configuration 15:
  • cpe:/o:siemens:simatic_ipc627e_firmware:*:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:simatic_ipc627e:-:*:*:*:*:*:*:*

    • Configuration 16:
  • cpe:/o:siemens:simatic_ipc647e_firmware:*:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:simatic_ipc647e:-:*:*:*:*:*:*:*

    • Configuration 17:
  • cpe:/o:siemens:simatic_ipc677e_firmware:*:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:simatic_ipc677e:-:*:*:*:*:*:*:*

    • Configuration 18:
  • cpe:/o:siemens:simatic_ipc847e_firmware:*:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:simatic_ipc847e:-:*:*:*:*:*:*:*

    • Configuration 19:
  • cpe:/o:siemens:simatic_itp1000_firmware:*:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:simatic_itp1000:-:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:insyde:insydeh2o:5.1:*:*:*:*:*:*:*
  • OR cpe:/a:insyde:insydeh2o:5.2:*:*:*:*:*:*:*
  • OR cpe:/a:insyde:insydeh2o:5.3:*:*:*:*:*:*:*
  • OR cpe:/a:insyde:insydeh2o:5.4:*:*:*:*:*:*:*
  • OR cpe:/a:insyde:insydeh2o:5.5:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    insyde insydeh2o *
    insyde insydeh2o *
    insyde insydeh2o *
    insyde insydeh2o *
    insyde insydeh2o *
    siemens simatic field pg m5 firmware *
    siemens simatic field pg m5 -
    siemens simatic field pg m6 firmware *
    siemens simatic field pg m6 -
    siemens simatic ipc127e firmware *
    siemens simatic ipc127e -
    siemens simatic ipc227g firmware *
    siemens simatic ipc227g -
    siemens simatic ipc277g firmware *
    siemens simatic ipc277g -
    siemens simatic ipc327g firmware *
    siemens simatic ipc327g -
    siemens simatic ipc377g firmware *
    siemens simatic ipc377g -
    siemens simatic ipc427e firmware *
    siemens simatic ipc427e -
    siemens simatic ipc477e firmware *
    siemens simatic ipc477e -
    siemens simatic ipc627e firmware *
    siemens simatic ipc627e -
    siemens simatic ipc647e firmware *
    siemens simatic ipc647e -
    siemens simatic ipc677e firmware *
    siemens simatic ipc677e -
    siemens simatic ipc847e firmware *
    siemens simatic ipc847e -
    siemens simatic itp1000 firmware *
    siemens simatic itp1000 -
    insyde insydeh2o 5.1
    insyde insydeh2o 5.2
    insyde insydeh2o 5.3
    insyde insydeh2o 5.4
    insyde insydeh2o 5.5