Vulnerability Name:

CVE-2021-42554 (CCN-218668)

Assigned:2021-10-18
Published:2022-02-01
Updated:2022-03-08
Summary:An issue was discovered in Insyde InsydeH2O with Kernel 5.0 before 05.08.42, Kernel 5.1 before 05.16.42, Kernel 5.2 before 05.26.42, Kernel 5.3 before 05.35.42, Kernel 5.4 before 05.42.51, and Kernel 5.5 before 05.50.51. An SMM memory corruption vulnerability in FvbServicesRuntimeDxe allows a possible attacker to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM.
CVSS v3 Severity:8.2 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)
7.1 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): High
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
7.8 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
6.8 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:7.2 High (CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
6.8 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:S/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-787
Vulnerability Consequences:Gain Privileges
References:Source: MITRE
Type: CNA
CVE-2021-42554

Source: CCN
Type: US-CERT VU#796611
InsydeH2O UEFI software impacted by multiple vulnerabilities in SMM

Source: CONFIRM
Type: Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf

Source: XF
Type: UNKNOWN
insyde-cve202142554-priv-esc(218668)

Source: CONFIRM
Type: Third Party Advisory
https://security.netapp.com/advisory/ntap-20220216-0007/

Source: CCN
Type: Lenovo Security Advisory: LEN-73436
InsydeH2O UEFI System Management Mode (SMM) Vulnerabilities

Source: CCN
Type: Insyde Web site
Insyde Software Security Advisory

Source: MISC
Type: Vendor Advisory
https://www.insyde.com/security-pledge

Source: MISC
Type: Vendor Advisory
https://www.insyde.com/security-pledge/SA-2022012

Vulnerable Configuration:Configuration 1:
  • cpe:/a:insyde:insydeh2o:*:*:*:*:*:*:*:* (Version >= 5.0 and < 5.08.42)

    • Configuration 2:
  • cpe:/a:insyde:insydeh2o:*:*:*:*:*:*:*:* (Version >= 5.1 and < 5.16.42)

    • Configuration 3:
  • cpe:/a:insyde:insydeh2o:*:*:*:*:*:*:*:* (Version >= 5.2 and < 5.26.42)

    • Configuration 4:
  • cpe:/a:insyde:insydeh2o:*:*:*:*:*:*:*:* (Version >= 5.3 and < 5.35.42)

    • Configuration 5:
  • cpe:/a:insyde:insydeh2o:*:*:*:*:*:*:*:* (Version >= 5.4 and < 5.42.51)

    • Configuration 6:
  • cpe:/a:insyde:insydeh2o:*:*:*:*:*:*:*:* (Version >= 5.5 and < 5.50.51)

    • Configuration 7:
  • cpe:/o:siemens:simatic_field_pg_m5_firmware:*:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:simatic_field_pg_m5:-:*:*:*:*:*:*:*

    • Configuration 8:
  • cpe:/o:siemens:simatic_field_pg_m6_firmware:*:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:simatic_field_pg_m6:-:*:*:*:*:*:*:*

    • Configuration 9:
  • cpe:/o:siemens:simatic_ipc127e_firmware:*:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:simatic_ipc127e:-:*:*:*:*:*:*:*

    • Configuration 10:
  • cpe:/o:siemens:simatic_ipc227g_firmware:*:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:simatic_ipc227g:-:*:*:*:*:*:*:*

    • Configuration 11:
  • cpe:/o:siemens:simatic_ipc277g_firmware:*:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:simatic_ipc277g:-:*:*:*:*:*:*:*

    • Configuration 12:
  • cpe:/o:siemens:simatic_ipc327g_firmware:*:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:simatic_ipc327g:-:*:*:*:*:*:*:*

    • Configuration 13:
  • cpe:/o:siemens:simatic_ipc377g_firmware:*:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:simatic_ipc377g:-:*:*:*:*:*:*:*

    • Configuration 14:
  • cpe:/o:siemens:simatic_ipc427e_firmware:*:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:simatic_ipc427e:-:*:*:*:*:*:*:*

    • Configuration 15:
  • cpe:/o:siemens:simatic_ipc477e_firmware:*:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:simatic_ipc477e:-:*:*:*:*:*:*:*

    • Configuration 16:
  • cpe:/o:siemens:simatic_ipc627e_firmware:*:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:simatic_ipc627e:-:*:*:*:*:*:*:*

    • Configuration 17:
  • cpe:/o:siemens:simatic_ipc647e_firmware:*:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:simatic_ipc647e:-:*:*:*:*:*:*:*

    • Configuration 18:
  • cpe:/o:siemens:simatic_ipc677e_firmware:*:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:simatic_ipc677e:-:*:*:*:*:*:*:*

    • Configuration 19:
  • cpe:/o:siemens:simatic_ipc847e_firmware:*:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:simatic_ipc847e:-:*:*:*:*:*:*:*

    • Configuration 20:
  • cpe:/o:siemens:simatic_itp1000_firmware:*:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:simatic_itp1000:-:*:*:*:*:*:*:*

    • Configuration 21:
  • cpe:/o:siemens:ruggedcom_ape1808_firmware:*:*:*:*:*:*:*:*
  • AND
  • cpe:/h:siemens:ruggedcom_ape1808:-:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:insyde:insydeh2o:5.1:*:*:*:*:*:*:*
  • OR cpe:/a:insyde:insydeh2o:5.2:*:*:*:*:*:*:*
  • OR cpe:/a:insyde:insydeh2o:5.3:*:*:*:*:*:*:*
  • OR cpe:/a:insyde:insydeh2o:5.4:*:*:*:*:*:*:*
  • OR cpe:/a:insyde:insydeh2o:5.5:*:*:*:*:*:*:*
  • OR cpe:/a:insyde:insydeh2o:5.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    insyde insydeh2o *
    insyde insydeh2o *
    insyde insydeh2o *
    insyde insydeh2o *
    insyde insydeh2o *
    insyde insydeh2o *
    siemens simatic field pg m5 firmware *
    siemens simatic field pg m5 -
    siemens simatic field pg m6 firmware *
    siemens simatic field pg m6 -
    siemens simatic ipc127e firmware *
    siemens simatic ipc127e -
    siemens simatic ipc227g firmware *
    siemens simatic ipc227g -
    siemens simatic ipc277g firmware *
    siemens simatic ipc277g -
    siemens simatic ipc327g firmware *
    siemens simatic ipc327g -
    siemens simatic ipc377g firmware *
    siemens simatic ipc377g -
    siemens simatic ipc427e firmware *
    siemens simatic ipc427e -
    siemens simatic ipc477e firmware *
    siemens simatic ipc477e -
    siemens simatic ipc627e firmware *
    siemens simatic ipc627e -
    siemens simatic ipc647e firmware *
    siemens simatic ipc647e -
    siemens simatic ipc677e firmware *
    siemens simatic ipc677e -
    siemens simatic ipc847e firmware *
    siemens simatic ipc847e -
    siemens simatic itp1000 firmware *
    siemens simatic itp1000 -
    siemens ruggedcom ape1808 firmware *
    siemens ruggedcom ape1808 -
    insyde insydeh2o 5.1
    insyde insydeh2o 5.2
    insyde insydeh2o 5.3
    insyde insydeh2o 5.4
    insyde insydeh2o 5.5
    insyde insydeh2o 5.0