CVE-2021-45971

An issue was discovered in SdHostDriver in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 before 05.35.25, 5.4 before 05.43.25, and 5.5 before 05.51.25. A vulnerability exists in the SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pointer (CommBufferData).

CVSS v3.0 8.2 HIGH
CVSS v2.0 7.2 HIGH

8.2^/10

CVSS v3.0 : HIGH

Vector :

Exploitability : 1.5 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://www.insyde.com/security-pledge	Vendor Advisory
https://security.netapp.com/advisory/ntap-20220216-0004/	Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf	Third Party Advisory

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*

Configuration 4 (hide)

cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*

Configuration 5 (hide)

cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*

Information

Published : 2022-01-05 16:15

Updated : 2022-03-29 09:35

NVD link : CVE-2021-45971

Mitre link : CVE-2021-45971

JSON object : View

CWE

CWE-787

Out-of-bounds Write

Advertisement

Products Affected

insyde

insydeh2o

Show plain JSON

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://www.insyde.com/security-pledge", "name": "https://www.insyde.com/security-pledge", "tags": ["Vendor Advisory"], "refsource": "MISC"}, {"url": "https://security.netapp.com/advisory/ntap-20220216-0004/", "name": "https://security.netapp.com/advisory/ntap-20220216-0004/", "tags": ["Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf", "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf", "tags": ["Third Party Advisory"], "refsource": "CONFIRM"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "An issue was discovered in SdHostDriver in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 before 05.35.25, 5.4 before 05.43.25, and 5.5 before 05.51.25. A vulnerability exists in the SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pointer (CommBufferData)."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-787"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2021-45971", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "severity": "HIGH", "acInsufInfo": false, "impactScore": 10.0, "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "baseMetricV3": {"cvssV3": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.5}}, "publishedDate": "2022-01-06T00:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "5.16.25", "versionStartIncluding": "5.1"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "5.26.25", "versionStartIncluding": "5.2"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "5.35.25", "versionStartIncluding": "5.3"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "5.43.25", "versionStartIncluding": "5.4"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "05.51.25", "versionStartIncluding": "5.5"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2022-03-29T16:35Z"}

{

cve : { »

data_type : CVE (string)

references : { »

reference_data : [ »

0 : { »

url : https://www.insyde.com/security-pledge (string)

name : https://www.insyde.com/security-pledge (string)

tags : [ »

0 : Vendor Advisory (string)

]

refsource : MISC (string)

}

1 : { »

url : https://security.netapp.com/advisory/ntap-20220216-0004/ (string)

name : https://security.netapp.com/advisory/ntap-20220216-0004/ (string)

tags : [ »

0 : Third Party Advisory (string)

]

refsource : CONFIRM (string)

}

2 : { »

url : https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf (string)

name : https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf (string)

tags : [ »

0 : Third Party Advisory (string)

]

refsource : CONFIRM (string)

}

]

}

data_format : MITRE (string)

description : { »

description_data : [ »

0 : { »

lang : en (string)

value : An issue was discovered in SdHostDriver in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 before 05.35.25, 5.4 before 05.43.25, and 5.5 before 05.51.25. A vulnerability exists in the SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pointer (CommBufferData). (string)

}

]

}

problemtype : { »

problemtype_data : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-787 (string)

}

]

}

]

}

data_version : 4.0 (string)

CVE_data_meta : { »

ID : CVE-2021-45971 (string)

ASSIGNER : cve@mitre.org (string)

}

}

impact : { »

baseMetricV2 : { »

cvssV2 : { »

version : 2.0 (string)

baseScore : 7.2 (number)

accessVector : LOCAL (string)

vectorString : AV:L/AC:L/Au:N/C:C/I:C/A:C (string)

authentication : NONE (string)

integrityImpact : COMPLETE (string)

accessComplexity : LOW (string)

availabilityImpact : COMPLETE (string)

confidentialityImpact : COMPLETE (string)

}

severity : HIGH (string)

acInsufInfo : false (boolean)

impactScore : 10 (number)

obtainAllPrivilege : false (boolean)

exploitabilityScore : 3.9 (number)

obtainUserPrivilege : false (boolean)

obtainOtherPrivilege : false (boolean)

userInteractionRequired : false (boolean)

}

baseMetricV3 : { »

cvssV3 : { »

scope : CHANGED (string)

version : 3.1 (string)

baseScore : 8.2 (number)

attackVector : LOCAL (string)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H (string)

integrityImpact : HIGH (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : HIGH (string)

privilegesRequired : HIGH (string)

confidentialityImpact : HIGH (string)

}

impactScore : 6 (number)

exploitabilityScore : 1.5 (number)

}

}

publishedDate : 2022-01-06T00:15Z (string)

configurations : { »

nodes : [ »

0 : { »

children : [ *empty* ]

operator : OR (string)

cpe_match : [ »

0 : { »

cpe23Uri : cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:* (string)

cpe_name : [ *empty* ]

vulnerable : true (boolean)

versionEndExcluding : 5.16.25 (string)

versionStartIncluding : 5.1 (string)

}

]

}

1 : { »

children : [ *empty* ]

operator : OR (string)

cpe_match : [ »

0 : { »

cpe23Uri : cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:* (string)

cpe_name : [ *empty* ]

vulnerable : true (boolean)

versionEndExcluding : 5.26.25 (string)

versionStartIncluding : 5.2 (string)

}

]

}

2 : { »

children : [ *empty* ]

operator : OR (string)

cpe_match : [ »

0 : { »

cpe23Uri : cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:* (string)

cpe_name : [ *empty* ]

vulnerable : true (boolean)

versionEndExcluding : 5.35.25 (string)

versionStartIncluding : 5.3 (string)

}

]

}

3 : { »

children : [ *empty* ]

operator : OR (string)

cpe_match : [ »

0 : { »

cpe23Uri : cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:* (string)

cpe_name : [ *empty* ]

vulnerable : true (boolean)

versionEndExcluding : 5.43.25 (string)

versionStartIncluding : 5.4 (string)

}

]

}

4 : { »

children : [ *empty* ]

operator : OR (string)

cpe_match : [ »

0 : { »

cpe23Uri : cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:* (string)

cpe_name : [ *empty* ]

vulnerable : true (boolean)

versionEndExcluding : 05.51.25 (string)

versionStartIncluding : 5.5 (string)

}

]

}

]

CVE_data_version : 4.0 (string)

}

lastModifiedDate : 2022-03-29T16:35Z (string)

}