Insyde InsydeH2O (SdMmcDevice shared buffer, DMA TOCTOU): Shared-buffer DMA race in the SD/MMC device layer, kernel 5.1

Impact

Shared-buffer DMA race in the SD/MMC device layer, kernel 5.1 through 5.5. Pairs with the SdHostDriver entry - Insyde consistently files the controller and device layers separately, so both need to be present in whatever BIOS release you accept as the fix.

Who can reach it

An attacker able to drive DMA at host memory while the SMI handler is mid-flight - a malicious PCIe device, a peripheral running attacker-flashed firmware (NIC, GPU, NVMe), or a tenant with a passed-through device that is not behind a correctly configured IOMMU. Notably does NOT require host root, which is what separates this family from the ordinary SMM callout bugs.

What to do

Firmware flash from the server OEM, not from Insyde - the fixed Insyde kernel has to be rebased by Dell/HPE/Lenovo/Supermicro and re-qualified before it reaches you, which for this batch ran months behind Insyde's own release. One reboot per node, so schedule it against a GPU drain. Insyde lists kernel 5.0 through 5.5 affected; take the per-kernel fixed version from the advisory. The compensating control that actually works here is the IOMMU, and Insyde says so in the advisory: enable VT-d/AMD-Vi with pre-boot DMA protection so the ACPI runtime buffer the handler reads is not reachable by an untrusted device. That is a BIOS setting, deployable fleet-wide without a flash, and it should be on already on any node that passes devices through to tenants. This is Insyde's second pass at the same defect class in a different set of buffers - a fleet that took the 2022 BIOS release is NOT covered for this batch, and OEM release notes rarely make that distinction clear. Verify by kernel version, not by 'we patched the Insyde DMA bugs'.

References

Related entries

• Insyde InsydeH2O (NvmExpressDxe shared buffer, DMA TOCTOU): The NVMe driver's SMM/non-SMM shared buffer is racy, givingCVE-2022-32955 · Insyde InsydeH2O (NvmExpressDxe shared buffer, DMA TOCTOU)High
• Insyde InsydeH2O (AhciBusDxe SMI input buffer, DMA TOCTOU): DMA race on the SATA/AHCI controller driver's SMI inputCVE-2022-33905 · Insyde InsydeH2O (AhciBusDxe SMI input buffer, DMA TOCTOU)High
• Insyde InsydeH2O (SdHostDriver SMI input buffer, DMA TOCTOU): DMA race on the SD host controller driver gives SMRAMCVE-2022-33908 · Insyde InsydeH2O (SdHostDriver SMI input buffer, DMA TOCTOU)High
• Insyde InsydeH2O (HddPassword SMI input buffer, DMA TOCTOU): The HddPassword driver handles ATA securityCVE-2022-33909 · Insyde InsydeH2O (HddPassword SMI input buffer, DMA TOCTOU)High
• Insyde InsydeH2O (NvmExpressLegacy SMI input buffer, DMA TOCTOU): DMA race on the legacy NVMe SMI handlerCVE-2022-33983 · Insyde InsydeH2O (NvmExpressLegacy SMI input buffer, DMA TOCTOU)High
• Insyde InsydeH2O (SdMmcDevice SMI input buffer, DMA TOCTOU): SMRAM corruption through a DMA race on the SD/MMC deviceCVE-2022-33984 · Insyde InsydeH2O (SdMmcDevice SMI input buffer, DMA TOCTOU)High