CVE-2021-43613: SysPasswordDxe: Password hashes are exposed in runtime UEFI variables, leading to escalation of privilege
An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. User and administrator password hashes are exposed in runtime UEFI variables, leading to escalation of privilege
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Insyde InsydeH2O SysPasswordDxeto a version that resolves this vulnerability.Fixed in 05.52.09 - Compensating control
Mitigate by preventing access to runtime UEFI variables containing SysPasswordDxe password hashes (e.g., restrict physical/management access so untrusted parties cannot read runtime UEFI variables).
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The CVSS vector indicates that an attacker needs local access and low privileges. No user interaction is required.
What security impact can result from exposed password hashes?
The issue can lead to escalation of privilege through exposure of user and administrator password hashes in runtime UEFI variables. The listed impact is integrity impact, with no stated confidentiality or availability impact.