CVE-2020-5953 HIGH

Published: 2022-02-03 | Last Modified: 2026-08-11 | Status: Modified

Description

A vulnerability exists in System Management Interrupt (SWSMI) handler of InsydeH2O UEFI Firmware code located in SWSMI handler that dereferences gRT (EFI_RUNTIME_SERVICES) pointer to call a GetVariable service, which is located outside of SMRAM. This can result in code execution in SMM (escalating privilege from ring 0 to ring -2).

Additional Descriptions (1)

Se presenta una vulnerabilidad en el manejador de Interrupciones de administración del Sistema (SWSMI) del código del Firmware UEFI de InsydeH2O ubicado en el manejador SWSMI que desreferencia el puntero gRT (EFI_RUNTIME_SERVICES) para llamar a un servicio GetVariable, que es encontrado fuera de la SMRAM. Esto puede resultar en una ejecución de código en SMM (escalando el privilegio del anillo 0 al anillo -2)

CVSS Metrics

Base Score: 7.5 (HIGH)

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector	LOCAL
Attack Complexity	HIGH
Privileges Required	HIGH
User Interaction	NONE
Scope	CHANGED
Confidentiality Impact	HIGH
Integrity Impact	HIGH
Availability Impact	HIGH

Source: [email protected]

Type: Primary

Exploitability Score: 0.8

Impact Score: 6.0

Base Score: 6.9 (MEDIUM)

AV:L/AC:M/Au:N/C:C/I:C/A:C

Access Vector	LOCAL
Access Complexity	MEDIUM
Authentication	NONE
Confidentiality Impact	COMPLETE
Integrity Impact	COMPLETE
Availability Impact	COMPLETE

Source: [email protected]

Type: Primary

Exploitability Score: 3.4

Impact Score: 10.0

Weaknesses

Source	Type	Description
[email protected]	Primary	en NVD-CWE-noinfo

Affected Products

Vendor	Product	Version	Update	Type
insyde	insydeh2o	5.12.09.0074	<built-in method update of dict object at 0x72f080107840>	Application
insyde	insydeh2o	5.23.04.0045	<built-in method update of dict object at 0x72f03a95eb40>	Application
insyde	insydeh2o	5.23.45.0023	<built-in method update of dict object at 0x72f059355bc0>	Application
insyde	insydeh2o	5.33.15.0034	<built-in method update of dict object at 0x72effec6e140>	Application
insyde	insydeh2o	5.34.03.0029	<built-in method update of dict object at 0x72f0781fd640>	Application
insyde	insydeh2o	5.42.03.0010	<built-in method update of dict object at 0x72f0781fe000>	Application
siemens	ruggedcom_ape1808_firmware	-	<built-in method update of dict object at 0x72f059356200>	Operating System
siemens	simatic_field_pg_m6_firmware	-	<built-in method update of dict object at 0x72f059354b00>	Operating System
siemens	simatic_ipc127e_firmware	-	<built-in method update of dict object at 0x72f059357400>	Operating System
siemens	simatic_ipc227g_firmware	-	<built-in method update of dict object at 0x72f0781fe380>	Operating System
siemens	simatic_ipc277g_firmware	-	<built-in method update of dict object at 0x72f059357a80>	Operating System
siemens	simatic_itp1000_firmware	-	<built-in method update of dict object at 0x72f03a95c080>	Operating System
siemens	simatic_ipc477e_pro_firmware	-	<built-in method update of dict object at 0x72efbe6b3440>	Operating System
siemens	simatic_ipc627e_firmware	-	<built-in method update of dict object at 0x72f059356d80>	Operating System
siemens	simatic_ipc647e_firmware	-	<built-in method update of dict object at 0x72f05a703bc0>	Operating System
siemens	simatic_ipc677e_firmware	-	<built-in method update of dict object at 0x72efbe6b3780>	Operating System
siemens	simatic_ipc847e_firmware	-	<built-in method update of dict object at 0x72f0781fca00>	Operating System
siemens	simatic_ipc327g_firmware	-	<built-in method update of dict object at 0x72f059356940>	Operating System
siemens	simatic_ipc377g_firmware	-	<built-in method update of dict object at 0x72f059357bc0>	Operating System
siemens	simatic_ipc427e_firmware	-	<built-in method update of dict object at 0x72f0803e01c0>	Operating System
siemens	simatic_ipc477e_firmware	-	<built-in method update of dict object at 0x72efbe6b1540>	Operating System
siemens	simatic_field_pg_m5_firmware	-	<built-in method update of dict object at 0x72f03a95f200>	Operating System

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:a:insyde:insydeh2o:5.12.09.0074:::::::*`
Yes	`cpe:2.3:a:insyde:insydeh2o:5.23.04.0045:::::::*`
Yes	`cpe:2.3:a:insyde:insydeh2o:5.23.45.0023:::::::*`
Yes	`cpe:2.3:a:insyde:insydeh2o:5.33.15.0034:::::::*`
Yes	`cpe:2.3:a:insyde:insydeh2o:5.34.03.0029:::::::*`
Yes	`cpe:2.3:a:insyde:insydeh2o:5.42.03.0010:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:ruggedcom_ape1808_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:ruggedcom_ape1808:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_field_pg_m6_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_field_pg_m6:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc127e_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc127e:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc227g_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc227g:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc277g_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc277g:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_itp1000_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_itp1000:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc477e_pro_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc477e_pro:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc627e_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc627e:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc647e_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc647e:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc677e_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc677e:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc847e_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc847e:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc327g_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc327g:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc377g_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc377g:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc427e_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc427e:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc477e_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc477e:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_field_pg_m5_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_field_pg_m5:-:::::::*`

References

https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf
Source: [email protected]

Third Party Advisory
https://security.netapp.com/advisory/ntap-20220222-0005/
Source: [email protected]

Third Party Advisory
https://www.insyde.com/products
Source: [email protected]

Product Vendor Advisory
https://www.insyde.com/security-pledge
Source: [email protected]

Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf
Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory
https://security.netapp.com/advisory/ntap-20220222-0005/
Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory
https://www.insyde.com/products
Source: af854a3a-2127-422b-91ae-364da2661108

Product Vendor Advisory
https://www.insyde.com/security-pledge
Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory
https://www.kb.cert.org/vuls/id/796611
Source: af854a3a-2127-422b-91ae-364da2661108
https://cert-portal.siemens.com/productcert/html/ssa-306654.html
Source: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e