Description
A vulnerability exists in System Management Interrupt (SWSMI) handler of InsydeH2O UEFI Firmware code located in SWSMI handler that dereferences gRT (EFI_RUNTIME_SERVICES) pointer to call a GetVariable service, which is located outside of SMRAM. This can result in code execution in SMM (escalating privilege from ring 0 to ring -2).
CVSS breakdown
CVSS 3.1
Attack Vector
Local
Attack Complexity
High
Privileges Required
High
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
Affected products
- insyde / insydeh2o5.12.09.0074 – 5.12.09.0074
- insyde / insydeh2o5.23.04.0045 – 5.23.04.0045
- insyde / insydeh2o5.23.45.0023 – 5.23.45.0023
- insyde / insydeh2o5.33.15.0034 – 5.33.15.0034
- insyde / insydeh2o5.34.03.0029 – 5.34.03.0029
- insyde / insydeh2o5.42.03.0010 – 5.42.03.0010
- Siemens / ruggedcom_ape1808_firmware
- Siemens / simatic_field_pg_m5_firmware
- Siemens / simatic_field_pg_m6_firmware
- Siemens / simatic_ipc127e_firmware
- Siemens / simatic_ipc227g_firmware
- Siemens / simatic_ipc277g_firmware
- Siemens / simatic_ipc327g_firmware
- Siemens / simatic_ipc377g_firmware
- Siemens / simatic_ipc427e_firmware
- Siemens / simatic_ipc477e_firmware
- Siemens / simatic_ipc477e_pro_firmware
- Siemens / simatic_ipc627e_firmware
- Siemens / simatic_ipc647e_firmware
- Siemens / simatic_ipc677e_firmware
- Siemens / simatic_ipc847e_firmware
- Siemens / simatic_itp1000_firmware
Updated 28m ago · 8 sources