IM
IronMonkey Threat Research

CVE-2021-33627 HIGH

Published: 2022-02-03 | Last Modified: 2026-08-11 | Status: Modified

Description

An issue was discovered in Insyde InsydeH2O Kernel 5.0 before 05.09.11, 5.1 before 05.17.11, 5.2 before 05.27.11, 5.3 before 05.36.11, 5.4 before 05.44.11, and 5.5 before 05.52.11 affecting FwBlockServiceSmm. Software SMI services that use the Communicate() function of the EFI_SMM_COMMUNICATION_PROTOCOL do not check whether the address of the buffer is valid, which allows use of SMRAM, MMIO, or OS kernel addresses.

Additional Descriptions (1)

Se ha descubierto un problema en InsydeH2O versión 5.x, que afecta a FwBlockServiceSmm. Los servicios SMI de software que utilizan la función Communicate() del EFI_SMM_COMMUNICATION_PROTOCOL no comprueban si la dirección del búfer es válida, lo que permite el uso de direcciones SMRAM, MMIO o del núcleo del SO

CVSS Metrics

Base Score: 8.2 (HIGH)

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack VectorLOCAL
Attack ComplexityLOW
Privileges RequiredHIGH
User InteractionNONE
ScopeCHANGED
Confidentiality ImpactHIGH
Integrity ImpactHIGH
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 1.5

Impact Score: 6.0

Base Score: 7.2 (HIGH)

AV:L/AC:L/Au:N/C:C/I:C/A:C

Access VectorLOCAL
Access ComplexityLOW
AuthenticationNONE
Confidentiality ImpactCOMPLETE
Integrity ImpactCOMPLETE
Availability ImpactCOMPLETE

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 10.0

Weaknesses

Source Type Description
[email protected] Primary
en CWE-119

Affected Products

Vendor Product Version Update Type
insyde insydeh2o * <built-in method update of dict object at 0x72f05a3a6240> Application
insyde insydeh2o * <built-in method update of dict object at 0x72f05a795400> Application
insyde insydeh2o * <built-in method update of dict object at 0x72f05a4efd00> Application
insyde insydeh2o * <built-in method update of dict object at 0x72efbccaed00> Application
siemens simatic_field_pg_m5_firmware * <built-in method update of dict object at 0x72f0592d4380> Operating System
siemens simatic_field_pg_m6_firmware * <built-in method update of dict object at 0x72f0592d7e40> Operating System
siemens simatic_ipc127e_firmware * <built-in method update of dict object at 0x72f05a4edc80> Operating System
siemens simatic_ipc227g_firmware * <built-in method update of dict object at 0x72f03af46300> Operating System
siemens simatic_ipc277g_firmware * <built-in method update of dict object at 0x72f08056c040> Operating System
siemens simatic_ipc327g_firmware * <built-in method update of dict object at 0x72f0592d6940> Operating System
siemens simatic_ipc377g_firmware * <built-in method update of dict object at 0x72f05a3a4840> Operating System
siemens simatic_ipc427e_firmware * <built-in method update of dict object at 0x72effec6e040> Operating System
siemens simatic_ipc477e_firmware * <built-in method update of dict object at 0x72f0805a5fc0> Operating System
siemens simatic_ipc627e_firmware * <built-in method update of dict object at 0x72f05a795780> Operating System
siemens simatic_ipc647e_firmware * <built-in method update of dict object at 0x72f03af446c0> Operating System
siemens simatic_ipc677e_firmware * <built-in method update of dict object at 0x72effedcc4c0> Operating System
siemens simatic_ipc847e_firmware * <built-in method update of dict object at 0x72f03af47600> Operating System
siemens simatic_itp1000_firmware * <built-in method update of dict object at 0x72f05a3a7180> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_field_pg_m5_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_field_pg_m5:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_field_pg_m6_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_field_pg_m6:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_ipc127e_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_ipc127e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_ipc227g_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_ipc227g:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_ipc277g_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_ipc277g:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_ipc327g_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_ipc327g:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_ipc377g_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_ipc377g:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_ipc427e_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_ipc427e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_ipc477e_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_ipc477e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_ipc627e_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_ipc627e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_ipc647e_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_ipc647e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_ipc677e_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_ipc677e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_ipc847e_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_ipc847e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_itp1000_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_itp1000:-:*:*:*:*:*:*:*

References

Notification
Message here