InsydeH2O vulnerabilities

An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. User and administrator password hashes are exposed in runtime UEFI variables, leading to escalation of privilege.

An issue was discovered in NvmExpressDxe in InsydeH2O with kernels 5.1 through 5.5. An SMM memory corruption vulnerability allows an attacker to write fixed or predictable data to SMRAM, potentially escalating privileges to SMM.

A vulnerability in AhciBusDxe in InsydeH2O with kernel 5.1-5.5 involves SMM memory corruption, allowing an attacker to write fixed or predictable data to SMRAM, potentially leading to privilege escalation to SMM.

An issue was discovered in HddPassword in InsydeH2O with kernels 5.1 through 5.5. An SMM memory corruption vulnerability allows an attacker to write fixed or predictable data to SMRAM, potentially escalating privileges to SMM.

A vulnerability in UsbCoreDxe in InsydeH2O (kernel 5.5 to 5.0) allows an attacker to hijack execution flow of code running in System Management Mode via an SMM callout. Exploitation could lead to privilege escalation to SMM.

A vulnerability in InsydeH2O with Kernel 5.0-5.5 involves SMM memory corruption in FvbServicesRuntimeDxe, allowing an attacker to write fixed or predictable data to SMRAM, potentially leading to privilege escalation to SMM.

A vulnerability in StorageSecurityCommandDxe in InsydeH2O with Kernel 5.1-5.3 involves an SMM callout that allows an attacker to hijack execution flow of code running in System Management Mode, potentially leading to privilege escalation to SMM.

A vulnerability in InsydeH2O Kernel allows an attacker to hijack execution flow of code running in System Management Mode via an Int15ServiceSmm SMM callout. Exploiting this issue could lead to escalating privileges to SMM.

In InsydeH2O Kernel 5.0 through 5.4 before specific versions, a stack-based buffer overflow in the UEFI DisplayTypeDxe DXE driver can lead to arbitrary code execution.

A vulnerability in AhciBusDxe in InsydeH2O with kernel 5.0-5.5 allows an attacker to access System Management Mode and execute arbitrary code, due to inclusion of functionality from an untrusted control sphere.

A vulnerability in NvmExpressDxe in InsydeH2O with kernel 5.0-5.5 allows an attacker to access System Management Mode and execute arbitrary code, due to inclusion of functionality from an untrusted control sphere.

An issue was discovered in NvmExpressDxe in InsydeH2O for kernels 5.0 through 5.5. An untrusted pointer dereference causes SMM memory corruption, allowing an attacker to write fixed or predictable data to SMRAM, potentially escalating privileges to SMM.

An issue was discovered in SdHostDriver in InsydeH2O for kernels 5.0 through 5.5. An SMM callout allows an attacker to access System Management Mode and execute arbitrary code, due to a numeric range comparison without a minimum check.

An issue was discovered in AhciBusDxe in InsydeH2O for kernels 5.0 through 5.5. An untrusted pointer dereference causes SMM memory corruption, allowing an attacker to write fixed or predictable data to SMRAM, potentially escalating privileges to SMM.

A vulnerability in InsydeH2O Kernel 5.0-5.5 affecting FwBlockServiceSmm. Software SMI services using Communicate() do not validate buffer addresses, allowing use of SMRAM, MMIO, or OS kernel addresses.

A vulnerability in InsydeH2O Kernel 5.x affecting HddPassword. Software SMI services using Communicate() do not validate buffer addresses, allowing use of SMRAM, MMIO, or OS kernel addresses.

A vulnerability exists in the SWSMI handler of InsydeH2O UEFI firmware that dereferences the gRT pointer to call a GetVariable service located outside SMRAM. This can result in code execution in SMM, escalating privileges from ring 0 to ring -2.

An issue was discovered in AhciBusDxe in InsydeH2O with kernels 5.0 through 5.5. An SMM callout vulnerability allows an attacker to hijack the execution flow of code running in System Management Mode, potentially escalating privileges to SMM.

An issue was discovered in InsydeH2O with kernels 5.1 through 5.3 (up to 2021-11-08). A StorageSecurityCommandDxe SMM memory corruption vulnerability allows an attacker to write fixed or predictable data to SMRAM, potentially escalating privileges to SMM.

An issue was discovered in SdHostDriver in InsydeH2O with kernels 5.1 through 5.5. A vulnerability in the SMM branch registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pointer (CommBufferData).

A vulnerability in IdeBusDxe in InsydeH2O with kernel 5.1-5.5 involves a SWSMI handler that does not sufficiently validate the allocated buffer pointer, potentially allowing an attacker to manipulate SMRAM data.

An issue was discovered in AhciBusDxe in InsydeH2O with kernels 5.1 through 5.5. A vulnerability in the SMM branch registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pointer (the CommBuffer+8 location).

A vulnerability in SMM branch registers a SWSMI handler that does not sufficiently validate the allocated buffer pointer (QWORD values for CommBuffer), allowing an attacker to corrupt SMRAM memory and potentially execute arbitrary code.

In InsydeH2O 5.x, certain SMM drivers did not correctly validate CommBuffer and CommBufferSize parameters, allowing callers to corrupt firmware or OS memory. Affected drivers include AhciBusDxe, IdeBusDxe, NvmExpressDxe, SdHostDriverDxe, and SdMmcDeviceDxe.