CVE-2021-42554 HIGH

Published: 2022-02-03 | Last Modified: 2026-08-11 | Status: Modified

Description

An issue was discovered in Insyde InsydeH2O with Kernel 5.0 before 05.08.42, Kernel 5.1 before 05.16.42, Kernel 5.2 before 05.26.42, Kernel 5.3 before 05.35.42, Kernel 5.4 before 05.42.51, and Kernel 5.5 before 05.50.51. An SMM memory corruption vulnerability in FvbServicesRuntimeDxe allows a possible attacker to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM.

Additional Descriptions (1)

Se ha descubierto un problema en InsydeH2O con el Kernel versión 5.0 antes de 05.08.42, el Kernel 5.1 antes de 05.16.42, el Kernel versión 5.2 antes de 05.26.42, el Kernel versión 5.3 antes de 05.35.42, el Kernel versión 5.4 antes de 05.42.51 y el Kernel versión 5.5 antes de 05.50.51. Una vulnerabilidad de corrupción de memoria SMM en FvbServicesRuntimeDxe permite a un posible atacante escribir datos fijos o predecibles en la SMRAM. La explotación de este problema podría llevar a escalar privilegios a SMM.

CVSS Metrics

Base Score: 8.2 (HIGH)

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector	LOCAL
Attack Complexity	LOW
Privileges Required	HIGH
User Interaction	NONE
Scope	CHANGED
Confidentiality Impact	HIGH
Integrity Impact	HIGH
Availability Impact	HIGH

Source: [email protected]

Type: Primary

Exploitability Score: 1.5

Impact Score: 6.0

Base Score: 7.2 (HIGH)

AV:L/AC:L/Au:N/C:C/I:C/A:C

Access Vector	LOCAL
Access Complexity	LOW
Authentication	NONE
Confidentiality Impact	COMPLETE
Integrity Impact	COMPLETE
Availability Impact	COMPLETE

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 10.0

Weaknesses

Source	Type	Description
[email protected]	Primary	en CWE-787

Affected Products

Vendor	Product	Version	Update	Type
insyde	insydeh2o	*	<built-in method update of dict object at 0x72f0592d4cc0>	Application
insyde	insydeh2o	*	<built-in method update of dict object at 0x72f03af44780>	Application
insyde	insydeh2o	*	<built-in method update of dict object at 0x72f03a95c9c0>	Application
insyde	insydeh2o	*	<built-in method update of dict object at 0x72f03a95e2c0>	Application
insyde	insydeh2o	*	<built-in method update of dict object at 0x72f0592d7d80>	Application
insyde	insydeh2o	*	<built-in method update of dict object at 0x72f0592d4380>	Application
siemens	simatic_field_pg_m5_firmware	*	<built-in method update of dict object at 0x72f03a95fa80>	Operating System
siemens	simatic_field_pg_m6_firmware	*	<built-in method update of dict object at 0x72f03a95e700>	Operating System
siemens	simatic_ipc127e_firmware	*	<built-in method update of dict object at 0x72effeddca40>	Operating System
siemens	simatic_ipc227g_firmware	*	<built-in method update of dict object at 0x72f0592d7e40>	Operating System
siemens	simatic_ipc277g_firmware	*	<built-in method update of dict object at 0x72effee34e00>	Operating System
siemens	simatic_ipc327g_firmware	*	<built-in method update of dict object at 0x72effec6de40>	Operating System
siemens	simatic_ipc377g_firmware	*	<built-in method update of dict object at 0x72f03a95c440>	Operating System
siemens	simatic_ipc427e_firmware	*	<built-in method update of dict object at 0x72effec6ff40>	Operating System
siemens	simatic_ipc477e_firmware	*	<built-in method update of dict object at 0x72f08056f1c0>	Operating System
siemens	simatic_ipc627e_firmware	*	<built-in method update of dict object at 0x72f05a4ef180>	Operating System
siemens	simatic_ipc647e_firmware	*	<built-in method update of dict object at 0x72effec6c380>	Operating System
siemens	simatic_ipc677e_firmware	*	<built-in method update of dict object at 0x72f03a95d000>	Operating System
siemens	simatic_ipc847e_firmware	*	<built-in method update of dict object at 0x72f03a95e000>	Operating System
siemens	simatic_itp1000_firmware	*	<built-in method update of dict object at 0x72f05a6bb480>	Operating System
siemens	ruggedcom_ape1808_firmware	*	<built-in method update of dict object at 0x72f05a796000>	Operating System

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:a:insyde:insydeh2o::::::::`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:a:insyde:insydeh2o::::::::`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:a:insyde:insydeh2o::::::::`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:a:insyde:insydeh2o::::::::`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:a:insyde:insydeh2o::::::::`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:a:insyde:insydeh2o::::::::`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_field_pg_m5_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_field_pg_m5:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_field_pg_m6_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_field_pg_m6:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc127e_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc127e:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc227g_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc227g:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc277g_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc277g:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc327g_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc327g:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc377g_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc377g:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc427e_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc427e:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc477e_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc477e:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc627e_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc627e:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc647e_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc647e:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc677e_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc677e:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_ipc847e_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_ipc847e:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:simatic_itp1000_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:simatic_itp1000:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:siemens:ruggedcom_ape1808_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:siemens:ruggedcom_ape1808:-:::::::*`

References

https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf
Source: [email protected]

Third Party Advisory
https://security.netapp.com/advisory/ntap-20220216-0007/
Source: [email protected]

Third Party Advisory
https://www.insyde.com/security-pledge
Source: [email protected]

Vendor Advisory
https://www.insyde.com/security-pledge/SA-2022012
Source: [email protected]

Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf
Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory
https://security.netapp.com/advisory/ntap-20220216-0007/
Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory
https://www.insyde.com/security-pledge
Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory
https://www.insyde.com/security-pledge/SA-2022012
Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory
https://www.kb.cert.org/vuls/id/796611
Source: af854a3a-2127-422b-91ae-364da2661108
https://cert-portal.siemens.com/productcert/html/ssa-306654.html
Source: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e