Cybersecurity specialists report the detection of a set of critical vulnerabilities in the UEFI firmware of InsydeH20, used by technology companies such as Acer, AMD, ASUS, Dell, HP, Intel, Lenovo and Microsoft, among others. As you may recall, UEFI is an interface between a device’s firmware and its operating system that carries out the boot process, in addition to performing system diagnostics and some repair functions.
The report prepared by the security firm Binarly, points to the discovery of 23 flaws in the InsydeH2O UEFI firmware, most of them in the System Management Mode (SMM). SMM privileges exceed those of the operating system kernel, so any security issues in this space can lead to a critical scenario.
According to experts, local or remote hackers with administrator privileges could exploit flaws and perform multiple malicious tasks, including:
- Disable many hardware security features (SecureBoot, Intel BootGuard and others)
- Install persistent malware
- Create backdoors and hidden communication channels for the theft of confidential information
Of the 23 reported flaws, experts noted that those tracked as CVE-2021-45969, CVE-2021-45970 and CVE-2021-45971 are the most severe, receiving scores of 9.8/10 according to the Common Vulnerability Scoring System (CVSS).
Ten of these vulnerabilities could be exploited to perform privilege escalation attacks, twelve more are memory corruption bugs in SMM, and the latest is described as a memory corruption vulnerability in the InsydeH2O runtime environment.
Developers have already released some updates to address the flaws, in addition to publishing detailed reports related to each reported flaw. The update process could take time because patches must be adopted by OEMs and subsequently shipped to affected product users.
In addition to the time it will take to process, experts note that it is unlikely that all affected products will receive the updates as they have reached the end of their useful life or may become obsolete when installing the update. Manufacturers such as Fujitsu and Intel have already begun to address the flaws, while others continue to investigate the reports and analyze the current conditions of their products.
To learn more about information security risks, malware variants, vulnerabilities and information technologies, feel free to access the International Institute of Cyber Security (IICS) websites.
He is a cyber security and malware researcher. He studied Computer Science and started working as a cyber security analyst in 2006. He is actively working as an cyber security investigator. He also worked for different security companies. His everyday job includes researching about new cyber security incidents. Also he has deep level of knowledge in enterprise security implementation.