CVE-2021-33626 HIGH

Published: 2021-10-01 | Last Modified: 2026-08-11 | Status: Modified

Description

A vulnerability exists in SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pointer(QWORD values for CommBuffer). This can be used by an attacker to corrupt data in SMRAM memory and even lead to arbitrary code execution.

Additional Descriptions (1)

Existe una vulnerabilidad en la rama SMM (System Management Mode) que registra un manejador SWSMI que no comprueba o valida suficientemente el puntero del buffer asignado (valores QWORD para CommBuffer). Esto puede ser utilizado por un atacante para corromper los datos en la memoria SMRAM e incluso llevar a la ejecución de código arbitrario

CVSS Metrics

Base Score: 7.8 (HIGH)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector	LOCAL
Attack Complexity	LOW
Privileges Required	LOW
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	HIGH
Integrity Impact	HIGH
Availability Impact	HIGH

Source: [email protected]

Type: Primary

Exploitability Score: 1.8

Impact Score: 5.9

Base Score: 4.6 (MEDIUM)

AV:L/AC:L/Au:N/C:P/I:P/A:P

Access Vector	LOCAL
Access Complexity	LOW
Authentication	NONE
Confidentiality Impact	PARTIAL
Integrity Impact	PARTIAL
Availability Impact	PARTIAL

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 6.4

Weaknesses

Source	Type	Description
[email protected]	Primary	en CWE-829

Affected Products

Vendor	Product	Version	Update	Type
insyde	insydeh2o	*	<built-in method update of dict object at 0x72efbdcbe2c0>	Operating System
insyde	insydeh2o	*	<built-in method update of dict object at 0x72f05a4ef180>	Operating System
insyde	insydeh2o	*	<built-in method update of dict object at 0x72f03a95dc40>	Operating System
insyde	insydeh2o	*	<built-in method update of dict object at 0x72effec6e800>	Operating System
insyde	insydeh2o	*	<built-in method update of dict object at 0x72efbdcbc280>	Operating System
insyde	insydeh2o	*	<built-in method update of dict object at 0x72f05824e600>	Operating System
insyde	insydeh2o	*	<built-in method update of dict object at 0x72f0582b42c0>	Operating System
siemens	ruggedcom_apr1808_firmware	-	<built-in method update of dict object at 0x72efbcce38c0>	Operating System
siemens	simatic_field_pg_m5_firmware	-	<built-in method update of dict object at 0x72f05824fec0>	Operating System
siemens	simatic_field_pg_m6_firmware	-	<built-in method update of dict object at 0x72efbdcbf180>	Operating System
siemens	simatic_ipc127e_firmware	-	<built-in method update of dict object at 0x72f05a797300>	Operating System
siemens	simatic_ipc227g_firmware	-	<built-in method update of dict object at 0x72efbdcbf080>	Operating System
siemens	simatic_ipc277g_firmware	-	<built-in method update of dict object at 0x72f03a95ffc0>	Operating System
siemens	simatic_ipc327g_firmware	-	<built-in method update of dict object at 0x72effee355c0>	Operating System
siemens	simatic_ipc377g_firmware	-	<built-in method update of dict object at 0x72f0804b7540>	Operating System
siemens	simatic_ipc427e_firmware	-	<built-in method update of dict object at 0x72f03a95fd40>	Operating System
siemens	simatic_ipc477e_firmware	-	<built-in method update of dict object at 0x72efbcce10c0>	Operating System
siemens	simatic_ipc477e_pro_firmware	-	<built-in method update of dict object at 0x72f05a795780>	Operating System
siemens	simatic_ipc627e_firmware	-	<built-in method update of dict object at 0x72f05a7975c0>	Operating System
siemens	simatic_ipc647e_firmware	-	<built-in method update of dict object at 0x72f07831b640>	Operating System
siemens	simatic_ipc677e_firmware	-	<built-in method update of dict object at 0x72f05a4efd00>	Operating System
siemens	simatic_ipc847e_firmware	-	<built-in method update of dict object at 0x72f05a4ee100>	Operating System
siemens	simatic_itp1000_firmware	-	<built-in method update of dict object at 0x72f03a95da40>	Operating System

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:insyde:insydeh2o::::::::`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:insyde:insydeh2o::::::::`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:insyde:insydeh2o::::::::`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:insyde:insydeh2o::::::::`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:insyde:insydeh2o::::::::`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:insyde:insydeh2o::::::::`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:insyde:insydeh2o::::::::`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:ruggedcom_apr1808_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:ruggedcom_apr1808:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_field_pg_m5_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_field_pg_m5:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_field_pg_m6_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_field_pg_m6:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc127e_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc127e:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc227g_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc227g:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc277g_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc277g:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc327g_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc327g:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc377g_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc377g:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc427e_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc427e:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc477e_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc477e:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc477e_pro_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc477e_pro:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc627e_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc627e:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc647e_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc647e:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc677e_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc677e:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc847e_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc847e:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_itp1000_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_itp1000:-:::::::*`

References

https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf
Source: [email protected]

Third Party Advisory
https://security.netapp.com/advisory/ntap-20220216-0006/
Source: [email protected]

Third Party Advisory
https://www.insyde.com/security-pledge
Source: [email protected]

Vendor Advisory
https://www.insyde.com/security-pledge/SA-2021001
Source: [email protected]

Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf
Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory
https://security.netapp.com/advisory/ntap-20220216-0006/
Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory
https://www.insyde.com/security-pledge
Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory
https://www.insyde.com/security-pledge/SA-2021001
Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory
https://www.kb.cert.org/vuls/id/796611
Source: af854a3a-2127-422b-91ae-364da2661108
https://cert-portal.siemens.com/productcert/html/ssa-306654.html
Source: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e