High · published February 3, 2022
An issue was discovered in Kernel 5.x in Insyde InsydeH2O, affecting HddPassword. Software SMI services that use the Communicate() function of the EFI_SMM_COMMUNICATION_PROTOCOL do not check whether the address of the buffer is valid, which allows use of SMRAM, MMIO, or OS kernel addresses.
| Product | Versions | Fixed in |
|---|---|---|
| insyde/insydeh2o | ≥ 5.1, < 5.16.23 | 5.16.23 |
| insyde/insydeh2o | ≥ 5.2, < 5.26.23 | 5.26.23 |
| insyde/insydeh2o | ≥ 5.3, < 5.35.23 | 5.35.23 |
| insyde/insydeh2o | ≥ 5.4, < 5.43.22 | 5.43.22 |
| insyde/insydeh2o | ≥ 5.5, < 5.51.22 | 5.51.22 |
| netapp/fas\/aff_bios | all versions | — |
| siemens/ruggedcom_ape1808_firmware | all versions | — |
| siemens/simatic_field_pg_m5_firmware | all versions | — |
| siemens/simatic_ipc127e_firmware | all versions | — |
| siemens/simatic_itp1000_firmware | all versions | — |
| siemens/simatic_ipc277g_firmware | all versions | — |
| siemens/simatic_ipc227g_firmware | all versions | — |
| siemens/simatic_ipc327g_firmware | all versions | — |
| siemens/simatic_ipc377g_firmware | all versions | — |
| siemens/simatic_ipc427e_firmware | all versions | — |
| siemens/simatic_ipc477e_firmware | all versions | — |
| siemens/simatic_ipc477e_pro_firmware | all versions | — |
| siemens/simatic_ipc627e_firmware | all versions | — |
| siemens/simatic_ipc647e_firmware | all versions | — |
| siemens/simatic_ipc677e_firmware | all versions | — |
| siemens/simatic_ipc847e_firmware | all versions | — |
| siemens/simatic_field_pg_m6_firmware | all versions | — |