Insyde InsydeH2O (IhisiSmm SMI handler): A malicious host OS calls an Insyde SMI handler with malformed arguments

Impact

A malicious host OS calls an Insyde SMI handler with malformed arguments and corrupts SMM memory. IHISI is Insyde's own firmware-services interface, used by BIOS update and configuration tooling, so it is reachable by design from the OS - the bug is that it trusts what it is told. Successful exploitation is ring -2 code execution: firmware persistence, attestation you can no longer believe, and a foothold under the hypervisor.

Who can reach it

Local admin/root on the host OS invoking the IHISI SMI interface with crafted arguments.

What to do

OEM BIOS update built on the fixed Insyde kernel (5.0-5.5 affected). Firmware flash plus one reboot per node. No config workaround - the interface is a supported firmware service and cannot be disabled. Reduce blast radius by restricting which host-side tools can issue SMIs and by not granting untrusted tenants root on bare metal running unpatched firmware. NCC Group published the underlying research, which is worth reading before assessing your exposure.

References