CVE-2021-41841 Code injection in n/a
An SMM callout vulnerability in InsydeH2O firmware allows attackers to execute arbitrary code in System Management Mode, compromising system integrity.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-41841?
CVE-2021-41841 is a high-severity code injection vulnerability in Insyde Insydeh2o, published on 3 Feb 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An issue was discovered in AhciBusDxe in the kernel 5.0 through 5.5 in Insyde InsydeH2O. There is an SMM callout that allows an attacker to access the System Management Mode and execute arbitrary code. This occurs because of Inclusion of Functionality from an Untrusted Control Sphere.
Weakness: CWE-829
Which versions are affected by CVE-2021-41841?
It affects 1 product.
Products include Insyde Insydeh2o.
How do I fix CVE-2021-41841?
No fix has been published for CVE-2021-41841 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2021-41841 being exploited?
There is no known exploitation of CVE-2021-41841 in the wild and no public exploit code.
Other vulnerabilities in Insyde Insydeh2o
Sources
Also known as GHSA-pfm8-cf33-8rhf.