Insyde InsydeH2O (IHISI function 0x49, UEFI variable factory reset): IHISI function 0x49 restores certain UEFI

Impact

IHISI function 0x49 restores certain UEFI variables to factory defaults with no authentication by default. That is a rollback primitive: an attacker resets security-relevant firmware settings that an operator had hardened - and on affected platforms can wind protections back to a weaker known state without needing to exploit anything. For a fleet where node hardening is applied once at provisioning and then assumed, this quietly undoes it, and nothing in the OS logs the change.

Who can reach it

Local attacker on the host OS able to invoke the IHISI interface. No authentication required on affected platforms.

What to do

OEM BIOS update carrying the Insyde fix, which makes the function require authentication. Firmware flash, reboot per node. Because the impact is settings rollback rather than code execution, the practical operator control is detection: baseline your BIOS settings at provisioning and re-verify them (via the OEM's redfish/BIOS-attribute API) on every node before it re-enters the tenant pool, rather than assuming a hardened node stays hardened.

References