CVE-2021-42060 An issue was discovered in Insyde InsydeH2O Kernel 5.0 through 05.08.41, Kernel 5.1 through 05.16.41, Kernel 5.2 before 05.23.22, and Kernel 5.3 before 05.32.22.

What is CVE-2021-42060?

CVE-2021-42060 is a high-severity vulnerability in Insyde Insydeh2o, published on 3 Feb 2022.

Official description

An issue was discovered in Insyde InsydeH2O Kernel 5.0 through 05.08.41, Kernel 5.1 through 05.16.41, Kernel 5.2 before 05.23.22, and Kernel 5.3 before 05.32.22. An Int15ServiceSmm SMM callout vulnerability allows an attacker to hijack execution flow of code running in System Management Mode. Exploiting this issue could lead to escalating privileges to SMM.

Which versions are affected by CVE-2021-42060?

It affects 1 product.

Products include Insyde Insydeh2o.

How do I fix CVE-2021-42060?

No fix has been published for CVE-2021-42060 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-42060 being exploited?

There is no known exploitation of CVE-2021-42060 in the wild and no public exploit code.

Other vulnerabilities in Insyde Insydeh2o

• CVE-2021-41842 Missing authorization in n/a Critical 9.8
• CVE-2023-22612 Memory corruption in n/a High 8.8
• CVE-2023-22613 Memory corruption in n/a High 8.8
• CVE-2023-22614 Memory corruption in n/a High 8.8
• CVE-2023-22615 Memory corruption in n/a High 8.4

All Insyde Insydeh2o vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2m37-rjqx-pvcg.