Insyde InsydeH2O (TrEEConfigDriver, TPM PCR reporting): Low CVSS, high operational consequence

Impact

Low CVSS, high operational consequence. The driver can report false TPM Platform Configuration Register values, which means the measurements a node presents during remote attestation do not reflect what actually booted. Every control an operator layers on top of measured boot - proving to a customer that their node runs the firmware and image you claim, gating access to model weights or key material on an attestation quote, detecting a bootkit left by the previous tenant - silently returns a pass on a compromised node. This is the bug class that turns every other firmware CVE in this list from detectable into invisible.

Who can reach it

Local attacker on the host able to influence the platform configuration the driver reports, then any subsequent attestation. The attack is against the verifier's trust, not against the node's availability.

What to do

OEM BIOS update on the fixed Insyde kernel; flash + reboot per node. No config workaround, because the whole point is that the reported state is wrong. Until patched, do not treat PCR-based attestation from affected platforms as authoritative for tenant-isolation or key-release decisions, and cross-check firmware integrity out of band (BMC-side SPI measurement, offline flash comparison) rather than trusting the node's own quote.

References