Insyde InsydeH2O (SystemFirmwareManagementRuntimeDxe, GetImage method): The firmware reads a runtime UEFI variable

CVSS 7.8CVE-2023-34195Firmware, BMC & network fabricINSYDE-SA-2023052curated

Impact

The firmware reads a runtime UEFI variable called GetImageProgress and then calls it as a function pointer. An attacker sets that variable from the OS to point at code they control and the firmware jumps to it during the DXE phase. This is a firmware-update-service driver, so the attacker ends up executing inside the machinery responsible for validating the next BIOS image - a direct route to a persistent, self-reinstalling firmware implant on a GPU node.

Who can reach it

Local admin/root on the host OS with UEFI variable write access, then a reboot or a firmware-management call that reaches GetImage.

What to do

OEM BIOS update carrying the fixed Insyde kernel (5.0-5.5 affected). Firmware flash, one reboot per node. No configuration mitigates it. Interim hardening: restrict OS-side UEFI variable writes, and where the platform supports it verify that capsule updates require a signed payload so an implant cannot re-flash itself through the same service.

References

https://nvd.nist.gov/vuln/detail/CVE-2023-34195 https://www.insyde.com/security-pledge/SA-2023052

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.