Insyde InsydeH2O (UsbLegacyControlSmm): A classic SMM callout: code running inside SMM calls out to a function pointer

Impact

A classic SMM callout: code running inside SMM calls out to a function pointer that lives in memory the OS can write. An attacker plants their own pointer, triggers the SMI, and their code runs at ring -2. USB legacy support is enabled by default on most server BIOS images, so the attack surface is present on nodes that have no USB device attached at all.

Who can reach it

Local admin/root on the host OS, then a software SMI into the USB legacy handler.

What to do

OEM BIOS update carrying the fixed Insyde kernel. Firmware flash, one reboot per node. Partial config workaround that is genuinely worth doing on servers: disable USB legacy support / USB emulation in BIOS setup - it is rarely needed on a headless GPU node and can be pushed via the OEM's remote BIOS-settings tooling without a flash. Verify on your platform that the setting actually unloads the driver rather than just hiding the option.

References