Insyde InsydeH2O (SystemFirmwareManagementRuntimeDxe, GetImage method): The firmware reads a runtime UEFI variable

Impact

The firmware reads a runtime UEFI variable called GetImageProgress and then calls it as a function pointer. An attacker sets that variable from the OS to point at code they control and the firmware jumps to it during the DXE phase. This is a firmware-update-service driver, so the attacker ends up executing inside the machinery responsible for validating the next BIOS image - a direct route to a persistent, self-reinstalling firmware implant on a GPU node.

Who can reach it

Local admin/root on the host OS with UEFI variable write access, then a reboot or a firmware-management call that reaches GetImage.

What to do

OEM BIOS update carrying the fixed Insyde kernel (5.0-5.5 affected). Firmware flash, one reboot per node. No configuration mitigates it. Interim hardening: restrict OS-side UEFI variable writes, and where the platform supports it verify that capsule updates require a signed payload so an implant cannot re-flash itself through the same service.

References