IM
IronMonkey Threat Research

CVE-2021-41838 HIGH

Published: 2022-02-03 | Last Modified: 2026-08-11 | Status: Modified

Description

An issue was discovered in SdHostDriver in the kernel 5.0 through 5.5 in Insyde InsydeH2O. There is an SMM callout that allows an attacker to access the System Management Mode and execute arbitrary code. This occurs because of a Numeric Range Comparison Without a Minimum Check.

Additional Descriptions (1)

Se ha descubierto un problema en SdHostDriver en el kernel versión 5.0 hasta la versión 5.5 en InsydeH2O. Hay una llamada SMM que permite a un atacante acceder al modo de gestión del sistema y ejecutar código arbitrario. Esto ocurre debido a una comparación de rango numérico sin una comprobación mínima.

CVSS Metrics

Base Score: 8.2 (HIGH)

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack VectorLOCAL
Attack ComplexityLOW
Privileges RequiredHIGH
User InteractionNONE
ScopeCHANGED
Confidentiality ImpactHIGH
Integrity ImpactHIGH
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 1.5

Impact Score: 6.0

Base Score: 7.2 (HIGH)

AV:L/AC:L/Au:N/C:C/I:C/A:C

Access VectorLOCAL
Access ComplexityLOW
AuthenticationNONE
Confidentiality ImpactCOMPLETE
Integrity ImpactCOMPLETE
Availability ImpactCOMPLETE

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 10.0

Weaknesses

Source Type Description
[email protected] Primary
en CWE-119

Affected Products

Vendor Product Version Update Type
insyde insydeh2o * <built-in method update of dict object at 0x72efbdb08080> Application
insyde insydeh2o * <built-in method update of dict object at 0x72f05a795400> Application
insyde insydeh2o * <built-in method update of dict object at 0x72f07831b300> Application
insyde insydeh2o * <built-in method update of dict object at 0x72f0582b42c0> Application
insyde insydeh2o * <built-in method update of dict object at 0x72efbe6b1e80> Application
siemens simatic_field_pg_m5_firmware * <built-in method update of dict object at 0x72efbe6b34c0> Operating System
siemens simatic_field_pg_m6_firmware * <built-in method update of dict object at 0x72f0592d5980> Operating System
siemens simatic_ipc127e_firmware * <built-in method update of dict object at 0x72efbdb0b3c0> Operating System
siemens simatic_ipc227g_firmware * <built-in method update of dict object at 0x72f0781ad300> Operating System
siemens simatic_ipc277g_firmware * <built-in method update of dict object at 0x72efbe6b3180> Operating System
siemens simatic_ipc327g_firmware * <built-in method update of dict object at 0x72f0781fe640> Operating System
siemens simatic_ipc377g_firmware * <built-in method update of dict object at 0x72efbdb0a0c0> Operating System
siemens simatic_ipc427e_firmware * <built-in method update of dict object at 0x72f05a700840> Operating System
siemens simatic_ipc477e_firmware * <built-in method update of dict object at 0x72efbe6b00c0> Operating System
siemens simatic_ipc627e_firmware * <built-in method update of dict object at 0x72efbdb0bf00> Operating System
siemens simatic_ipc647e_firmware * <built-in method update of dict object at 0x72f059924740> Operating System
siemens simatic_ipc677e_firmware * <built-in method update of dict object at 0x72f05a796000> Operating System
siemens simatic_ipc847e_firmware * <built-in method update of dict object at 0x72f05a795640> Operating System
siemens simatic_itp1000_firmware * <built-in method update of dict object at 0x72efbdb0bb40> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_field_pg_m5_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_field_pg_m5:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_field_pg_m6_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_field_pg_m6:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_ipc127e_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_ipc127e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_ipc227g_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_ipc227g:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_ipc277g_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_ipc277g:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_ipc327g_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_ipc327g:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_ipc377g_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_ipc377g:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_ipc427e_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_ipc427e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_ipc477e_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_ipc477e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_ipc627e_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_ipc627e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_ipc647e_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_ipc647e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_ipc677e_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_ipc677e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_ipc847e_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_ipc847e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_itp1000_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_itp1000:-:*:*:*:*:*:*:*

References

Notification
Message here