Insyde InsydeH2O (AtaLegacySmm SMM driver): The SMI handler in the legacy ATA driver does not validate the CommBuffer

Impact

The SMI handler in the legacy ATA driver does not validate the CommBuffer it is handed, so a caller from the OS can steer SMM into executing attacker-supplied code. That is full ring -2 control: persistence that survives OS reinstall and disk wipe, the ability to disable or forge Secure Boot and TPM measurements, and a vantage point beneath any hypervisor. The highest-scored entry in the whole 2021-2022 Insyde/Binarly batch.

Who can reach it

Local admin or root on the host OS, then a software SMI invoking the vulnerable handler. On bare-metal GPU rental this is exactly the privilege a tenant already has on their leased node.

What to do

InsydeH2O kernel fix (5.0 / 05.08.46, 5.1 / 05.16.46, 5.2 / 05.26.46, 5.3 / 05.35.46, 5.4 / 05.43.46, 5.5 / 05.51.45) - but you cannot apply that. You need the BIOS image your server OEM built on top of it, and the rebase lag from Insyde's kernel drop to a shipping Dell/HPE/Lenovo/Supermicro payload ran into many months for this batch. Firmware flash plus one reboot per node. No config workaround: SMM cannot be turned off. If you rent bare metal to untrusted tenants on unpatched firmware, treat every returned node as compromised and re-flash rather than reimage.

References

Related entries

• ArubaOS-Switch (HPE Aruba wired switches): Remote arbitrary code execution on ArubaOS-Switch devices, affectingCVE-2022-23676 · ArubaOS-Switch (HPE Aruba wired switches)Critical
• coreboot 4.13-4.16 (SMM handling on application processors): Arbitrary code execution in System Management ModeCVE-2022-29264 · coreboot 4.13-4.16 (SMM handling on application processors)Critical
• Ampere Altra and Altra Max UEFI reference design before SRP 1.09 - SMC interface exposing SPI-NOR flash: The OSCVE-2022-32295 · Ampere Altra and Altra Max UEFI reference design before SRP 1.09 - SMC interface exposing SPI-NOR flashCritical
• APC Easy UPS Online Monitoring Software (Windows and Windows Server): Critical functions in the UPS monitoring serverCVE-2022-42970 · APC Easy UPS Online Monitoring Software (Windows and Windows Server)Critical
• APC Easy UPS Online Monitoring Software (Windows and Windows Server): Unrestricted file upload leads to remote codeCVE-2022-42971 · APC Easy UPS Online Monitoring Software (Windows and Windows Server)Critical
• Ampere Altra and Altra Max before firmware 2.10c - PCIe root complex access control: The OS can re-initialise a PCIeCVE-2022-46892 · Ampere Altra and Altra Max before firmware 2.10c - PCIe root complex access controlCritical