Insyde InsydeH2O (AsfSecureBootDxe): Stack buffer overflow leading to arbitrary code execution during the DXE phase

Impact

Stack buffer overflow leading to arbitrary code execution during the DXE phase - and it lives in the driver responsible for Secure Boot handling for ASF (Alert Standard Format, the out-of-band manageability path). Code execution in DXE means running before the OS with firmware privileges and with Secure Boot policy still under the attacker's influence. Scored critical, and the placement inside the Secure Boot path is what makes it worse than the raw score suggests.

Who can reach it

Attacker able to supply the oversized input the DXE driver parses during boot. Given the ASF/manageability association, treat anything that can reach the platform's out-of-band alerting path as in scope alongside local OS-level access.

What to do

OEM BIOS update on the fixed Insyde kernel (5.0-5.5 affected). Firmware flash, reboot per node. No config workaround inside firmware; on the network side, keep the BMC and manageability interfaces on an isolated management VLAN with no route from tenant or provisioning networks - which is good practice independent of this CVE and materially reduces who can reach the ASF path.

References