Insyde InsydeH2O (MebxConfiguration DXE driver): A UEFI variable that the OS can write is read back by BIOS code

CVSS 8.2CVE-2022-36337Firmware, BMC & network fabricINSYDE-SA-2022039curated

Impact

A UEFI variable that the OS can write is read back by BIOS code into a fixed-size stack buffer without a length check. Set the variable from the OS, reboot, and your code runs during DXE - before Secure Boot has finished deciding what is allowed to run. The persistence mechanism is the variable store itself, which means the implant re-arms on every boot and survives disk replacement entirely.

Who can reach it

Local admin/root on the host OS with the ability to write UEFI variables (standard on Linux via efivarfs and on Windows via SetFirmwareEnvironmentVariable), then one reboot.

What to do

OEM BIOS update built on the fixed Insyde kernel. Firmware flash, reboot per node. There is no config toggle. Detection is possible in the interim: monitor for unexpected writes to the relevant UEFI variables from the OS, and make efivarfs read-only where your workload does not need it. On a fleet, treat any node where firmware variables changed outside a maintenance window as suspect.

References

https://nvd.nist.gov/vuln/detail/CVE-2022-36337 https://www.insyde.com/security-pledge/SA-2022039

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.