CVE-2020-5953
Summary
| CVE | CVE-2020-5953 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2022-02-03 01:15:00 UTC |
| Updated | 2022-04-12 18:17:00 UTC |
| Description | A vulnerability exists in System Management Interrupt (SWSMI) handler of InsydeH2O UEFI Firmware code located in SWSMI handler that dereferences gRT (EFI_RUNTIME_SERVICES) pointer to call a GetVariable service, which is located outside of SMRAM. This can result in code execution in SMM (escalating privilege from ring 0 to ring -2). |
Risk And Classification
Problem Types: NVD-CWE-noinfo
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Insyde | Insydeh2o | 5.12.09.0074 | All | All | All |
| Application | Insyde | Insydeh2o | 5.23.04.0045 | All | All | All |
| Application | Insyde | Insydeh2o | 5.23.45.0023 | All | All | All |
| Application | Insyde | Insydeh2o | 5.33.15.0034 | All | All | All |
| Application | Insyde | Insydeh2o | 5.34.03.0029 | All | All | All |
| Application | Insyde | Insydeh2o | 5.42.03.0010 | All | All | All |
| Hardware | Siemens | Ruggedcom Ape1808 | - | All | All | All |
| Operating System | Siemens | Ruggedcom Ape1808 Firmware | - | All | All | All |
| Hardware | Siemens | Simatic Field Pg M5 | - | All | All | All |
| Operating System | Siemens | Simatic Field Pg M5 Firmware | - | All | All | All |
| Hardware | Siemens | Simatic Field Pg M6 | - | All | All | All |
| Operating System | Siemens | Simatic Field Pg M6 Firmware | - | All | All | All |
| Hardware | Siemens | Simatic Ipc127e | - | All | All | All |
| Operating System | Siemens | Simatic Ipc127e Firmware | - | All | All | All |
| Hardware | Siemens | Simatic Ipc227g | - | All | All | All |
| Operating System | Siemens | Simatic Ipc227g Firmware | - | All | All | All |
| Hardware | Siemens | Simatic Ipc277g | - | All | All | All |
| Operating System | Siemens | Simatic Ipc277g Firmware | - | All | All | All |
| Hardware | Siemens | Simatic Ipc327g | - | All | All | All |
| Operating System | Siemens | Simatic Ipc327g Firmware | - | All | All | All |
| Hardware | Siemens | Simatic Ipc377g | - | All | All | All |
| Operating System | Siemens | Simatic Ipc377g Firmware | - | All | All | All |
| Hardware | Siemens | Simatic Ipc427e | - | All | All | All |
| Operating System | Siemens | Simatic Ipc427e Firmware | - | All | All | All |
| Hardware | Siemens | Simatic Ipc477e | - | All | All | All |
| Operating System | Siemens | Simatic Ipc477e Firmware | - | All | All | All |
| Hardware | Siemens | Simatic Ipc477e Pro | - | All | All | All |
| Operating System | Siemens | Simatic Ipc477e Pro Firmware | - | All | All | All |
| Hardware | Siemens | Simatic Ipc627e | - | All | All | All |
| Operating System | Siemens | Simatic Ipc627e Firmware | - | All | All | All |
| Hardware | Siemens | Simatic Ipc647e | - | All | All | All |
| Operating System | Siemens | Simatic Ipc647e Firmware | - | All | All | All |
| Hardware | Siemens | Simatic Ipc677e | - | All | All | All |
| Operating System | Siemens | Simatic Ipc677e Firmware | - | All | All | All |
| Hardware | Siemens | Simatic Ipc847e | - | All | All | All |
| Operating System | Siemens | Simatic Ipc847e Firmware | - | All | All | All |
| Hardware | Siemens | Simatic Itp1000 | - | All | All | All |
| Operating System | Siemens | Simatic Itp1000 Firmware | - | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Insyde's Security Pledge | Insyde Software | MISC | www.insyde.com | |
| cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf | CONFIRM | cert-portal.siemens.com | |
| CVE-2020-5953 InsydeH20 Vulnerability in NetApp Products | NetApp Product Security | CONFIRM | security.netapp.com | |
| InsydeH2O® UEFI BIOS | Insyde Software | MISC | www.insyde.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 590981 Siemens Industrial Products Insyde BIOS Multiple Vulnerabilities (SSA-306654)