Insyde InsydeH2O (UsbCoreDxe SMM module): Another SMM callout in the USB core driver

Impact

Another SMM callout in the USB core driver - improper input validation lets SMM be redirected into attacker-controlled code outside SMRAM, giving ring -2 execution. Notable mainly because it is the same driver family Insyde has now patched repeatedly (2021 through 2024), which tells an operator something useful: assume the USB stack in your BIOS will need patching again, and build the flash cadence to match rather than treating each one as a one-off.

Who can reach it

Local admin/root on the host OS triggering the vulnerable SMI.

What to do

OEM BIOS update on Insyde kernel 5.4 / 05.47.01, 5.5 / 05.55.01, 5.6 / 05.62.01, 5.7 / 05.71.01 or later. Firmware flash, one reboot per node. Partial config workaround: disable USB legacy/emulation support in BIOS on headless GPU nodes, which shrinks the reachable surface without a flash - but confirm on your platform that it actually unloads the SMM module.

References