CVE-2021-42113: High severity Insyde InsydeH2O vulnerability
An issue was discovered in StorageSecurityCommandDxe in Insyde InsydeH2O with Kernel 5.1 before 05.14.28, Kernel 5.2 before 05.24.28, and Kernel 5.3 before 05.32.25. An SMM callout vulnerability allows an attacker to hijack execution flow of code running in System Management Mode. Exploiting this issue could lead to escalating privileges to SMM.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-42113?
CVE-2021-42113 is an SMM callout vulnerability in StorageSecurityCommandDxe in Insyde InsydeH2O with Kernel 5.1 before 05.14.28, Kernel 5.2 before 05.24.28, and Kernel 5.3 before 05.32.25.
What is the severity of CVE-2021-42113?
CVE-2021-42113 has a severity rating of 8.2 (high).
How does CVE-2021-42113 affect Insyde InsydeH2O?
CVE-2021-42113 allows an attacker to hijack the execution flow of code running in System Management Mode (SMM) in Insyde InsydeH2O.
Which versions of Insyde InsydeH2O are affected by CVE-2021-42113?
Insyde InsydeH2O versions 5.1 to 5.14.34, 5.2 to 5.24.34, and 5.3 to 5.32.25 are affected by CVE-2021-42113.
How can I mitigate the vulnerability CVE-2021-42113?
To mitigate CVE-2021-42113, update Insyde InsydeH2O to a version higher than 5.14.34, 5.24.34, or 5.32.25, depending on the affected kernel version.