[ CVE-2021-42554 · Published 3 Feb 2022 ]
Vulnerability
Not scored yet
EPSS <1%1 agency advisoryFix available
[ Description ]Official description
An issue was discovered in Insyde InsydeH2O with Kernel 5.0 before 05.08.42, Kernel 5.1 before 05.16.42, Kernel 5.2 before 05.26.42, Kernel 5.3 before 05.35.42, Kernel 5.4 before 05.42.51, and Kernel 5.5 before 05.50.51. An SMM memory corruption vulnerability in FvbServicesRuntimeDxe allows a possible attacker to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM.
[ Fixes ]Fixes and patches
- Security bulletin: NetApp NTAP-20220216-0007Vendor patch or bulletin · CERT-FR · security.netapp.com/advisory/NTAP-20220216-0007, cited by CERT-FR CERTFR-2026-AVI-1410
[ Advisories ]Government CERT advisories
-
CERT-FRCERTFR-2026-AVI-1410
Vulnerability in NetApp products Translated from French
A vulnerability has been discovered in NetApp products. It allows an attacker to cause privilege escalation.
[ References ]References
- www.insyde.com/security-pledgex_refsource_MISC
- www.insyde.com/security-pledge/SA-2022012x_refsource_MISC
- security.netapp.com/advisory/ntap-20220216-0007x_refsource_CONFIRM
- cert-portal.siemens.com/productcert/pdf/ssa-306654.pdfx_refsource_CONFIRM