CVE-2021-42113

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-42113
An issue was discovered in StorageSecurityCommandDxe in Insyde InsydeH2O with Kernel 5.1 before 05.14.28, Kernel 5.2 before 05.24.28, and Kernel 5.3 before 05.32.25. An SMM callout vulnerability allows an attacker to hijack execution flow of code running in System Management Mode. Exploiting this issue could lead to escalating privileges to SMM.

8.2 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.5 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

4.6 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:L/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 3.9 / Impact : 6.4

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf Third Party Advisory
https://security.netapp.com/advisory/ntap-20220216-0012/ Third Party Advisory
https://www.insyde.com/security-pledge Vendor Advisory
https://www.insyde.com/security-pledge/SA-2022008 Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*
History

29 Mar 2022, 16:05

Type Values Removed Values Added
References (CONFIRM) https://security.netapp.com/advisory/ntap-20220216-0012/ - (CONFIRM) https://security.netapp.com/advisory/ntap-20220216-0012/ - Third Party Advisory
References (CONFIRM) https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf - (CONFIRM) https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf - Third Party Advisory

24 Feb 2022, 15:15

Type Values Removed Values Added
References
  • (CONFIRM) https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf -

17 Feb 2022, 01:15

Type Values Removed Values Added
References
  • (CONFIRM) https://security.netapp.com/advisory/ntap-20220216-0012/ -

10 Feb 2022, 01:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : 4.6
v3 : 8.2
CPE cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*
First Time Insyde
Insyde insydeh2o
References (MISC) https://www.insyde.com/security-pledge - (MISC) https://www.insyde.com/security-pledge - Vendor Advisory
References (MISC) https://www.insyde.com/security-pledge/SA-2022008 - (MISC) https://www.insyde.com/security-pledge/SA-2022008 - Vendor Advisory
CWE NVD-CWE-noinfo

09 Feb 2022, 02:15

Type Values Removed Values Added
References
  • (MISC) https://www.insyde.com/security-pledge/SA-2022008 -
Summary SMM callout vulnerability allowing a possible attacker to hijack execution flow of a code running in System Management Mode. Exploiting this issue could lead to escalating privileges to SMM. An issue was discovered in StorageSecurityCommandDxe in Insyde InsydeH2O with Kernel 5.1 before 05.14.28, Kernel 5.2 before 05.24.28, and Kernel 5.3 before 05.32.25. An SMM callout vulnerability allows an attacker to hijack execution flow of code running in System Management Mode. Exploiting this issue could lead to escalating privileges to SMM.

03 Feb 2022, 02:15

Type Values Removed Values Added
New CVE
Information

Published : 2022-02-03 02:15

Updated : 2023-12-10 14:09

NVD link : CVE-2021-42113

Mitre link : CVE-2021-42113

CVE.ORG link : CVE-2021-42113

JSON object : View

Products Affected

insyde

  • insydeh2o
CWE
NVD-CWE-noinfo