AI Threat Alert
CVE-2020-5953
AWAITING NVDA vulnerability exists in System Management Interrupt (SWSMI) handler of InsydeH2O UEFI Firmware code located in SWSMI handler that dereferences gRT (EFI_RUNTIME_SERVICES) pointer to call a GetVariable service, which is located outside of SMRAM. This can result in code execution in SMM (escalating...
Full CISO analysis pending enrichment.
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| n/a | — | — | No patch |
Do you use n/a? You're affected.
How severe is it?
What should I do?
No patch available
Monitor for updates. Consider compensating controls or temporary mitigations.
Which compliance frameworks are affected?
Compliance analysis pending. Sign in for full compliance mapping when available.
Frequently Asked Questions
What is CVE-2020-5953?
A vulnerability exists in System Management Interrupt (SWSMI) handler of InsydeH2O UEFI Firmware code located in SWSMI handler that dereferences gRT (EFI_RUNTIME_SERVICES) pointer to call a GetVariable service, which is located outside of SMRAM. This can result in code execution in SMM (escalating privilege from ring 0 to ring -2).
Is CVE-2020-5953 actively exploited?
No confirmed active exploitation of CVE-2020-5953 has been reported, but organizations should still patch proactively.
How to fix CVE-2020-5953?
No patch is currently available. Monitor vendor advisories for updates.
What is the CVSS score for CVE-2020-5953?
No CVSS score has been assigned yet.
What are the technical details?
Original Advisory
A vulnerability exists in System Management Interrupt (SWSMI) handler of InsydeH2O UEFI Firmware code located in SWSMI handler that dereferences gRT (EFI_RUNTIME_SERVICES) pointer to call a GetVariable service, which is located outside of SMRAM. This can result in code execution in SMM (escalating privilege from ring 0 to ring -2).
References
- cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf x_refsource_CONFIRM
- security.netapp.com/advisory/ntap-20220222-0005/ x_refsource_CONFIRM
- insyde.com/products x_refsource_MISC
- insyde.com/security-pledge x_refsource_MISC