Insyde InsydeH2O (MebxConfiguration DXE driver): A UEFI variable that the OS can write is read back by BIOS code

Impact

A UEFI variable that the OS can write is read back by BIOS code into a fixed-size stack buffer without a length check. Set the variable from the OS, reboot, and your code runs during DXE - before Secure Boot has finished deciding what is allowed to run. The persistence mechanism is the variable store itself, which means the implant re-arms on every boot and survives disk replacement entirely.

Who can reach it

Local admin/root on the host OS with the ability to write UEFI variables (standard on Linux via efivarfs and on Windows via SetFirmwareEnvironmentVariable), then one reboot.

What to do

OEM BIOS update built on the fixed Insyde kernel. Firmware flash, reboot per node. There is no config toggle. Detection is possible in the interim: monitor for unexpected writes to the relevant UEFI variables from the OS, and make efivarfs read-only where your workload does not need it. On a fleet, treat any node where firmware variables changed outside a maintenance window as suspect.

References