IM
IronMonkey Threat Research

CVE-2020-27339 HIGH

Published: 2021-06-16 | Last Modified: 2026-08-11 | Status: Modified

Description

In the kernel in Insyde InsydeH2O 5.x, certain SMM drivers did not correctly validate the CommBuffer and CommBufferSize parameters, allowing callers to corrupt either the firmware or the OS memory. The fixed versions for this issue in the AhciBusDxe, IdeBusDxe, NvmExpressDxe, SdHostDriverDxe, and SdMmcDeviceDxe drivers are 05.16.25, 05.26.25, 05.35.25, 05.43.25, and 05.51.25 (for Kernel 5.1 through 5.5).

Additional Descriptions (1)

En el kernel de Insyde InsydeH2O 5.x, algunos controladores SMM no validaban correctamente los parámetros CommBuffer y CommBufferSize, lo que permitía a los llamantes corromper el firmware o la memoria del sistema operativo. Las versiones corregidas para este problema en los controladores AhciBusDxe, IdeBusDxe, NvmExpressDxe, SdHostDriverDxe y SdMcDeviceDxe son 05.16.25, 05.26.25, 05.35.25, 05.43.25 y 05.51.25 (para los núcleos 5.1 a 5.5)

CVSS Metrics

Base Score: 6.7 (MEDIUM)

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack VectorLOCAL
Attack ComplexityLOW
Privileges RequiredHIGH
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactHIGH
Integrity ImpactHIGH
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 0.8

Impact Score: 5.9

Base Score: 7.2 (HIGH)

AV:L/AC:L/Au:N/C:C/I:C/A:C

Access VectorLOCAL
Access ComplexityLOW
AuthenticationNONE
Confidentiality ImpactCOMPLETE
Integrity ImpactCOMPLETE
Availability ImpactCOMPLETE

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 10.0

Weaknesses

Source Type Description
[email protected] Primary
en CWE-20

Affected Products

Vendor Product Version Update Type
insyde insydeh2o * <built-in method update of dict object at 0x72efbe6b20c0> Operating System
insyde insydeh2o * <built-in method update of dict object at 0x72f03a95f280> Operating System
insyde insydeh2o * <built-in method update of dict object at 0x72f03a95c880> Operating System
insyde insydeh2o * <built-in method update of dict object at 0x72efbe6b1140> Operating System
insyde insydeh2o * <built-in method update of dict object at 0x72f05a4ec7c0> Operating System
insyde insydeh2o * <built-in method update of dict object at 0x72effec6ed80> Operating System
insyde insydeh2o * <built-in method update of dict object at 0x72f059357240> Operating System
siemens ruggedcom_apr1808_firmware - <built-in method update of dict object at 0x72effec6e680> Operating System
siemens simatic_field_pg_m5_firmware - <built-in method update of dict object at 0x72efbdb0bdc0> Operating System
siemens simatic_field_pg_m6_firmware - <built-in method update of dict object at 0x72effec6c440> Operating System
siemens simatic_ipc127e_firmware - <built-in method update of dict object at 0x72f05a436f00> Operating System
siemens simatic_ipc227g_firmware - <built-in method update of dict object at 0x72f03a95d5c0> Operating System
siemens simatic_ipc277g_firmware - <built-in method update of dict object at 0x72f07831b5c0> Operating System
siemens simatic_ipc327g_firmware - <built-in method update of dict object at 0x72f05a4eed00> Operating System
siemens simatic_ipc377g_firmware - <built-in method update of dict object at 0x72f03a95e3c0> Operating System
siemens simatic_ipc427e_firmware - <built-in method update of dict object at 0x72f03a95df80> Operating System
siemens simatic_ipc477e_firmware - <built-in method update of dict object at 0x72f03a95e1c0> Operating System
siemens simatic_ipc477e_pro_firmware - <built-in method update of dict object at 0x72efbdb0a0c0> Operating System
siemens simatic_ipc627e_firmware - <built-in method update of dict object at 0x72f059357680> Operating System
siemens simatic_ipc647e_firmware - <built-in method update of dict object at 0x72f08066ef40> Operating System
siemens simatic_ipc677e_firmware - <built-in method update of dict object at 0x72f05a450040> Operating System
siemens simatic_ipc847e_firmware - <built-in method update of dict object at 0x72f03a95cac0> Operating System
siemens simatic_itp1000_firmware - <built-in method update of dict object at 0x72f0781ff1c0> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:insyde:insydeh2o:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:insyde:insydeh2o:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:insyde:insydeh2o:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:insyde:insydeh2o:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:insyde:insydeh2o:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:insyde:insydeh2o:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:insyde:insydeh2o:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:ruggedcom_apr1808_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:ruggedcom_apr1808:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_field_pg_m5_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_field_pg_m5:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_field_pg_m6_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_field_pg_m6:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_ipc127e_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_ipc127e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_ipc227g_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_ipc227g:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_ipc277g_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_ipc277g:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_ipc327g_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_ipc327g:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_ipc377g_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_ipc377g:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_ipc427e_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_ipc427e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_ipc477e_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_ipc477e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_ipc477e_pro_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_ipc477e_pro:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_ipc627e_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_ipc627e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_ipc647e_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_ipc647e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_ipc677e_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_ipc677e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_ipc847e_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_ipc847e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_itp1000_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_itp1000:-:*:*:*:*:*:*:*

References

Notification
Message here