CVE-2021-33625 HIGH

Published: 2022-02-03 | Last Modified: 2026-08-11 | Status: Modified

Description

An issue was discovered in Kernel 5.x in Insyde InsydeH2O, affecting HddPassword. Software SMI services that use the Communicate() function of the EFI_SMM_COMMUNICATION_PROTOCOL do not check whether the address of the buffer is valid, which allows use of SMRAM, MMIO, or OS kernel addresses.

Additional Descriptions (1)

Se ha descubierto un problema en el Kernel versión 5.x de InsydeH2O, que afecta a HddPassword. Los servicios SMI de software que utilizan la función Communicate() del EFI_SMM_COMMUNICATION_PROTOCOL no comprueban si la dirección del búfer es válida, lo que permite el uso de direcciones de SMRAM, MMIO o del núcleo del SO

CVSS Metrics

Base Score: 7.5 (HIGH)

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector	LOCAL
Attack Complexity	HIGH
Privileges Required	HIGH
User Interaction	NONE
Scope	CHANGED
Confidentiality Impact	HIGH
Integrity Impact	HIGH
Availability Impact	HIGH

Source: [email protected]

Type: Primary

Exploitability Score: 0.8

Impact Score: 6.0

Base Score: 6.9 (MEDIUM)

AV:L/AC:M/Au:N/C:C/I:C/A:C

Access Vector	LOCAL
Access Complexity	MEDIUM
Authentication	NONE
Confidentiality Impact	COMPLETE
Integrity Impact	COMPLETE
Availability Impact	COMPLETE

Source: [email protected]

Type: Primary

Exploitability Score: 3.4

Impact Score: 10.0

Weaknesses

Source	Type	Description
[email protected]	Primary	en CWE-119

Affected Products

Vendor	Product	Version	Update	Type
insyde	insydeh2o	*	<built-in method update of dict object at 0x72f03af45380>	Application
insyde	insydeh2o	*	<built-in method update of dict object at 0x72effec6ed00>	Application
insyde	insydeh2o	*	<built-in method update of dict object at 0x72f05a51cb00>	Application
insyde	insydeh2o	*	<built-in method update of dict object at 0x72f05824ed40>	Application
insyde	insydeh2o	*	<built-in method update of dict object at 0x72f03af46280>	Application
netapp	fas\/aff_bios	-	<built-in method update of dict object at 0x72f03af44140>	Operating System
siemens	ruggedcom_ape1808_firmware	-	<built-in method update of dict object at 0x72f059927e80>	Operating System
siemens	simatic_field_pg_m5_firmware	-	<built-in method update of dict object at 0x72f03af453c0>	Operating System
siemens	simatic_ipc127e_firmware	-	<built-in method update of dict object at 0x72f03af47a80>	Operating System
siemens	simatic_itp1000_firmware	-	<built-in method update of dict object at 0x72f03af46400>	Operating System
siemens	simatic_ipc277g_firmware	-	<built-in method update of dict object at 0x72f059926380>	Operating System
siemens	simatic_ipc227g_firmware	-	<built-in method update of dict object at 0x72f03af46500>	Operating System
siemens	simatic_ipc327g_firmware	-	<built-in method update of dict object at 0x72f0805a5fc0>	Operating System
siemens	simatic_ipc377g_firmware	-	<built-in method update of dict object at 0x72f05824f300>	Operating System
siemens	simatic_ipc427e_firmware	-	<built-in method update of dict object at 0x72f03af47a00>	Operating System
siemens	simatic_ipc477e_firmware	-	<built-in method update of dict object at 0x72f05824e600>	Operating System
siemens	simatic_ipc477e_pro_firmware	-	<built-in method update of dict object at 0x72f03af470c0>	Operating System
siemens	simatic_ipc627e_firmware	-	<built-in method update of dict object at 0x72efbdcbd500>	Operating System
siemens	simatic_ipc647e_firmware	-	<built-in method update of dict object at 0x72f03af45d00>	Operating System
siemens	simatic_ipc677e_firmware	-	<built-in method update of dict object at 0x72f05a0c8840>	Operating System
siemens	simatic_ipc847e_firmware	-	<built-in method update of dict object at 0x72f03af47740>	Operating System
siemens	simatic_field_pg_m6_firmware	-	<built-in method update of dict object at 0x72f03af44d00>	Operating System

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:a:insyde:insydeh2o::::::::`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:a:insyde:insydeh2o::::::::`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:a:insyde:insydeh2o::::::::`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:a:insyde:insydeh2o::::::::`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:a:insyde:insydeh2o::::::::`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:netapp:fas\/aff_bios:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:ruggedcom_ape1808_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:ruggedcom_ape1808:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_field_pg_m5_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_field_pg_m5:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc127e_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc127e:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_itp1000_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_itp1000:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc277g_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc277g:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc227g_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc227g:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc327g_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc327g:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc377g_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc377g:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc427e_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc427e:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc477e_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc477e:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc477e_pro_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc477e_pro:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc627e_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc627e:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc647e_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc647e:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc677e_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc677e:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc847e_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc847e:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_field_pg_m6_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_field_pg_m6:-:::::::*`

References

https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf
Source: [email protected]

Third Party Advisory
https://security.netapp.com/advisory/ntap-20220222-0004/
Source: [email protected]

Third Party Advisory
https://www.insyde.com/security-pledge
Source: [email protected]

Vendor Advisory
https://www.insyde.com/security-pledge/SA-2022014
Source: [email protected]

Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf
Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory
https://security.netapp.com/advisory/ntap-20220222-0004/
Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory
https://www.insyde.com/security-pledge
Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory
https://www.insyde.com/security-pledge/SA-2022014
Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory
https://www.kb.cert.org/vuls/id/796611
Source: af854a3a-2127-422b-91ae-364da2661108
https://cert-portal.siemens.com/productcert/html/ssa-306654.html
Source: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e