CVE-2021-33626

HighCVSS 7.8/10Last modified Aug 11, 2026

Description

A vulnerability exists in SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently check or validate the allocated buffer pointer(QWORD values for CommBuffer). This can be used by an attacker to corrupt data in SMRAM memory and even lead to arbitrary code execution.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-829

Affected software

No affected versions have been published.

Timeline

Published: Oct 1, 2021
Last modified: Aug 11, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-336278.2An issue was discovered in Insyde InsydeH2O Kernel 5.0 before 05.09.11, 5.1 before 05.17.11, 5.2 before 05.27.11, 5.3 before 05.36.11, 5.4 b CVE-2021-336297.5isula-build before 0.9.5-6 can cause a program crash, when building container images, some functions for processing external data do not rem CVE-2021-336305.5NULL Pointer Dereference vulnerability in openEuler kernel on Linux (network modules) allows Pointer Manipulation. This vulnerability is ass CVE-2021-336317.8Integer Overflow or Wraparound vulnerability in openEuler kernel on Linux (filesystem modules) allows Forced Integer Overflow.This issue aff CVE-2021-336327.0Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in openEuler iSulad on Linux allows Leveraging Time-of-Check and Time-of-Use CVE-2021-336337.3Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler aops-ceres on Linux al CVE-2021-336345.5iSulad uses the lcr+lxc runtime (default) to run malicious images, which can cause DOS.CVE-2021-336357.8When malicious images are pulled by isula pull, attackers can execute arbitrary code.CVE-2021-336367.8When the isula load command is used to load malicious images, attackers can execute arbitrary code.CVE-2021-336376.5When the isula export command is used to export a container to an image and the container is controlled by an attacker, the attacker can esc CVE-2021-336386.5When the isula cp command is used to copy files from a container to a host machine and the container is controlled by an attacker, the attac CVE-2021-336397.5REMAP cmd of SVM driver can be used to remap read only memory as read-write, then cause read only memory/file modified.