CVE-2021-42113: n/a SMM callout enables privilege

Q: Is CVE-2021-42113 actively exploited?

No confirmed active exploitation of CVE-2021-42113 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2021-42113?

1) Inventory hardware (especially on-prem GPU/AI training and inference servers) to identify which OEM systems run Insyde InsydeH2O firmware. 2) Apply the vendor BIOS/UEFI update that incorporates Insyde's fixed kernel builds (5.1 >=05.14.28, 5.2 >=05.24.28, 5.3 >=05.32.25) — consult the NetApp and Siemens product advisories linked to this CVE for affected model lists. 3) Limit and monitor who/what can obtain kernel-level OS access, since the SMM callout requires that access to trigger. 4) Where available, enable measured/secure boot and firmware integrity attestation (e.g., TPM-backed) to detect SMM tampering. No AI-specific detection or package patching applies.

CISO Take

This vulnerability sits in Insyde InsydeH2O UEFI/BIOS firmware, not in any AI/ML software package — the automated 'ml_library' tag on this CVE is a misclassification with no basis in the description or affected products. An SMM callout flaw in StorageSecurityCommandDxe lets an attacker who already has elevated OS-level access hijack execution flow into System Management Mode, the most privileged execution ring below the OS and hypervisor, enabling firmware-level persistence that survives OS reinstalls and evades most EDR. EPSS is low (0.297%, ~78th percentile), it is not in CISA KEV, and no public exploit or Nuclei template exists, so this is not being broadly exploited today — but SMM implants remain a prized capability for advanced, well-resourced actors targeting high-value infrastructure, including on-prem GPU training or inference hosts built on affected OEM hardware. Action: check with your hardware OEM whether affected systems ship Insyde InsydeH2O Kernel 5.1 (<05.14.28), 5.2 (<05.24.28), or 5.3 (<05.32.25), and apply the vendor BIOS update referenced in the NetApp and Siemens advisories; no AI package remediation is required.

Sources:NVDEPSSinsyde.comsecurity.netapp.comcert-portal.siemens.com

What is the risk?

Low likelihood, high impact if realized. Exploitation requires an attacker to already hold elevated OS/kernel-level access — this is a privilege-escalation-to-SMM primitive, not a remote initial-access vector — and there is no public exploit, no Nuclei template, low EPSS (0.297%), and no CISA KEV listing. That keeps near-term exploitation likelihood low. However, successful exploitation grants firmware-level, largely undetectable persistence, which is high-value to sophisticated/APT-style actors. Critically, this is a hardware/firmware supply-chain issue, not an AI/ML software vulnerability — none of our tracked AI packages are implicated.

How does the attack unfold?

Prerequisite access

Attacker already holds kernel-level or administrative OS access on the target host, obtained via an unrelated prior compromise.

SMM callout exploitation

Attacker triggers the vulnerable StorageSecurityCommandDxe SMM callout to hijack execution flow from OS context into System Management Mode.

Firmware-level persistence

Attacker leverages SMM-level control to implant persistence that survives OS reinstalls and evades OS-based security tooling.

Impact

Attacker maintains stealthy, long-term control of the underlying hardware, potentially including AI training/inference infrastructure running on affected OEM systems.

Prerequisite access

Attacker already holds kernel-level or administrative OS access on the target host, obtained via an unrelated prior compromise.

SMM callout exploitation

Attacker triggers the vulnerable StorageSecurityCommandDxe SMM callout to hijack execution flow from OS context into System Management Mode.

Firmware-level persistence

Attacker leverages SMM-level control to implant persistence that survives OS reinstalls and evades OS-based security tooling.

Impact

Attacker maintains stealthy, long-term control of the underlying hardware, potentially including AI training/inference infrastructure running on affected OEM systems.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n/a	—	—	No patch

Do you use n/a? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.3%

chance of exploitation in 30 days

Higher than 22% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Advanced

What should I do?

1 step

1) Inventory hardware (especially on-prem GPU/AI training and inference servers) to identify which OEM systems run Insyde InsydeH2O firmware. 2) Apply the vendor BIOS/UEFI update that incorporates Insyde's fixed kernel builds (5.1 >=05.14.28, 5.2 >=05.24.28, 5.3 >=05.32.25) — consult the NetApp and Siemens product advisories linked to this CVE for affected model lists. 3) Limit and monitor who/what can obtain kernel-level OS access, since the SMM callout requires that access to trigger. 4) Where available, enable measured/secure boot and firmware integrity attestation (e.g., TPM-backed) to detect SMM tampering. No AI-specific detection or package patching applies.

How is it classified?

Code ExecutionInference

Which compliance frameworks are affected?

This CVE is relevant to:

NIST AI RMF

GOVERN-6.1-Third-party/supply chain risk management

Frequently Asked Questions

What is CVE-2021-42113?

This vulnerability sits in Insyde InsydeH2O UEFI/BIOS firmware, not in any AI/ML software package — the automated 'ml_library' tag on this CVE is a misclassification with no basis in the description or affected products. An SMM callout flaw in StorageSecurityCommandDxe lets an attacker who already has elevated OS-level access hijack execution flow into System Management Mode, the most privileged execution ring below the OS and hypervisor, enabling firmware-level persistence that survives OS reinstalls and evades most EDR. EPSS is low (0.297%, ~78th percentile), it is not in CISA KEV, and no public exploit or Nuclei template exists, so this is not being broadly exploited today — but SMM implants remain a prized capability for advanced, well-resourced actors targeting high-value infrastructure, including on-prem GPU training or inference hosts built on affected OEM hardware. Action: check with your hardware OEM whether affected systems ship Insyde InsydeH2O Kernel 5.1 (<05.14.28), 5.2 (<05.24.28), or 5.3 (<05.32.25), and apply the vendor BIOS update referenced in the NetApp and Siemens advisories; no AI package remediation is required.

Is CVE-2021-42113 actively exploited?

No confirmed active exploitation of CVE-2021-42113 has been reported, but organizations should still patch proactively.

How to fix CVE-2021-42113?

1) Inventory hardware (especially on-prem GPU/AI training and inference servers) to identify which OEM systems run Insyde InsydeH2O firmware. 2) Apply the vendor BIOS/UEFI update that incorporates Insyde's fixed kernel builds (5.1 >=05.14.28, 5.2 >=05.24.28, 5.3 >=05.32.25) — consult the NetApp and Siemens product advisories linked to this CVE for affected model lists. 3) Limit and monitor who/what can obtain kernel-level OS access, since the SMM callout requires that access to trigger. 4) Where available, enable measured/secure boot and firmware integrity attestation (e.g., TPM-backed) to detect SMM tampering. No AI-specific detection or package patching applies.

What systems are affected by CVE-2021-42113?

This vulnerability affects the following AI/ML architecture patterns: on-prem GPU training/inference hardware (indirect, firmware-level only).

What is the CVSS score for CVE-2021-42113?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

on-prem GPU training/inference hardware (indirect, firmware-level only)

Compliance Controls Affected

NIST AI RMF: GOVERN-6.1

What are the technical details?

Original Advisory

An issue was discovered in StorageSecurityCommandDxe in Insyde InsydeH2O with Kernel 5.1 before 05.14.28, Kernel 5.2 before 05.24.28, and Kernel 5.3 before 05.32.25. An SMM callout vulnerability allows an attacker to hijack execution flow of code running in System Management Mode. Exploiting this issue could lead to escalating privileges to SMM.

Exploitation Scenario

An attacker who has already compromised kernel-level or administrative access on an on-prem AI training or inference server — via a separate initial-access vulnerability, stolen admin credentials, or insider access — invokes the vulnerable StorageSecurityCommandDxe SMM callout to hijack execution flow and escalate from OS-level privileges into System Management Mode. From SMM, the attacker can plant firmware-level persistence that survives OS reinstalls and disk wipes, disable security tooling, or quietly exfiltrate data from the compromised AI compute node, all while remaining largely invisible to OS-level monitoring. This is a post-exploitation persistence technique layered on top of an existing compromise, not an attack against any AI model, pipeline, or package.