CVE-2021-41837

An issue was discovered in AhciBusDxe in the kernel 5.0 through 5.5 in Insyde InsydeH2O. Because of an Untrusted Pointer Dereference that causes SMM memory corruption, an attacker may be able to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM.

Link	Resource
https://www.insyde.com/security-pledge	Vendor Advisory
https://www.insyde.com/security-pledge/SA-2022024	Vendor Advisory
https://security.netapp.com/advisory/ntap-20220222-0003/	Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf	Third Party Advisory

Configuration 1

cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:* cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:* cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:* cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:* cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:* cpe:2.3:a:insyde:insydeh2o:*:*:*:*:*:*:*:*

---

Published : 2022-02-03 02:15

Updated : 2022-03-01 07:43

---

NVD link : CVE-2021-41837

Mitre link : CVE-2021-41837

Siemens

Simatic Field Pg M5 Firmware

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer