CVE-2021-41841

HIGH

InsydeH2O 5.0-5.5 - Arbitrary Code Execution via SMM Callout in AhciBusDxe

Title source: llm
STIX 2.1

Description

An issue was discovered in AhciBusDxe in the kernel 5.0 through 5.5 in Insyde InsydeH2O. There is an SMM callout that allows an attacker to access the System Management Mode and execute arbitrary code. This occurs because of Inclusion of Functionality from an Untrusted Control Sphere.

References (5)

Core 5
Core References
Vendor Advisory x_refsource_misc
https://www.insyde.com/security-pledge
Vendor Advisory x_refsource_misc
https://www.insyde.com/security-pledge/SA-2022019
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20220217-0012/
Third Party Advisory x_refsource_confirm
https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf
Third Party Advisory, US Government Resource
https://www.kb.cert.org/vuls/id/796611

Scores

CVSS v3 8.2
EPSS 0.0029
EPSS Percentile 20.5%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Details

CWE
CWE-829
Status published
Products (1)
insyde/insydeh2o 5.0 - 5.08.29
Published Feb 03, 2022
Tracked Since Feb 18, 2026