Insyde's Security Pledge

AhciBusDxe: Improper input validation might lead to arbitrary code execution vulnerability at SMM level.

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N

CVE-2020-5952: AhciBusDxe module has an SMM call out vulnerability that could also be used to execute arbitrary code at SMM level.

Kernel 5.1: Version in 05.15.11
Kernel 5.2: Version in 05.25.11
Kernel 5.3: Version in 05.34.11
Kernel 5.4: Version in 05.42.11

Thanks 3rd party researchers, Yngweijw and Menghao Li of IIE Varas, for reporting the vulnerabilities and engaging in coordinated disclosure.