High · published February 3, 2022
A vulnerability exists in System Management Interrupt (SWSMI) handler of InsydeH2O UEFI Firmware code located in SWSMI handler that dereferences gRT (EFI_RUNTIME_SERVICES) pointer to call a GetVariable service, which is located outside of SMRAM. This can result in code execution in SMM (escalating privilege from ring 0 to ring -2).
| Product | Versions | Fixed in |
|---|---|---|
| insyde/insydeh2o | all versions | — |
| insyde/insydeh2o | all versions | — |
| insyde/insydeh2o | all versions | — |
| insyde/insydeh2o | all versions | — |
| insyde/insydeh2o | all versions | — |
| insyde/insydeh2o | all versions | — |
| siemens/ruggedcom_ape1808_firmware | all versions | — |
| siemens/simatic_field_pg_m6_firmware | all versions | — |
| siemens/simatic_ipc127e_firmware | all versions | — |
| siemens/simatic_ipc227g_firmware | all versions | — |
| siemens/simatic_ipc277g_firmware | all versions | — |
| siemens/simatic_itp1000_firmware | all versions | — |
| siemens/simatic_ipc477e_pro_firmware | all versions | — |
| siemens/simatic_ipc627e_firmware | all versions | — |
| siemens/simatic_ipc647e_firmware | all versions | — |
| siemens/simatic_ipc677e_firmware | all versions | — |
| siemens/simatic_ipc847e_firmware | all versions | — |
| siemens/simatic_ipc327g_firmware | all versions | — |
| siemens/simatic_ipc377g_firmware | all versions | — |
| siemens/simatic_ipc427e_firmware | all versions | — |
| siemens/simatic_ipc477e_firmware | all versions | — |
| siemens/simatic_field_pg_m5_firmware | all versions | — |