Vulnerability · Published Feb 3, 2022 · Assigned by mitre
CVE-2020-5953
High 7.5
In plain English
A high-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).
Severity (CVSS NVD)7.5High
Exploit odds (30 days)0.3%top 79.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A vulnerability exists in System Management Interrupt (SWSMI) handler of InsydeH2O UEFI Firmware code located in SWSMI handler that dereferences gRT (EFI_RUNTIME_SERVICES) pointer to call a GetVariable service, which is located outside of SMRAM. This can result in code execution in SMM (escalating privilege from ring 0 to ring -2).
Affected products (as reported)
References
- https://www.insyde.com/products x_refsource_MISC
- https://www.insyde.com/security-pledge x_refsource_MISC
- https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf x_refsource_CONFIRM
- https://security.netapp.com/advisory/ntap-20220222-0005/ x_refsource_CONFIRM
- https://www.kb.cert.org/vuls/id/796611
- https://cert-portal.siemens.com/productcert/html/ssa-306654.html