7.2

CVE-2022-1107

During an internal product security audit a potential vulnerability due to use of Boot Services in the SmmOEMInt15 SMI handler was discovered in some ThinkPad models could be exploited by an attacker with elevated privileges that could allow for execution of code.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Lenovo ≫ Thinkpad 11e Firmware Version < n15et78w
   Lenovo ≫ Thinkpad 11e Version -
Lenovo ≫ Thinkpad Helix Firmware Version < n17eta8w
   Lenovo ≫ Thinkpad Helix Version -
Lenovo ≫ Thinkpad L560 Firmware Version < n1het85w
   Lenovo ≫ Thinkpad L560 Version -
Lenovo ≫ Thinkpad L570 Firmware Version < n1xet65w
   Lenovo ≫ Thinkpad L570 Version -
Lenovo ≫ Thinkpad P50s Firmware Version < n1ket46w
   Lenovo ≫ Thinkpad P50s Version -
Lenovo ≫ Thinkpad P51s Firmware Version < n1vet50w
   Lenovo ≫ Thinkpad P51s Version -
Lenovo ≫ Thinkpad P52s Firmware Version < n27et36w
   Lenovo ≫ Thinkpad P52s Version -
Lenovo ≫ Thinkpad S540 Firmware Version < gpet80ww
   Lenovo ≫ Thinkpad S540 Version -
Lenovo ≫ Thinkpad T550 Firmware Version < n11et50w
   Lenovo ≫ Thinkpad T550 Version -
Lenovo ≫ Thinkpad T560 Firmware Version < n1ket46w
   Lenovo ≫ Thinkpad T560 Version -
Lenovo ≫ Thinkpad T570 Firmware Version < n1vet50w
   Lenovo ≫ Thinkpad T570 Version -
Lenovo ≫ Thinkpad T580 Firmware Version < n27et36w
   Lenovo ≫ Thinkpad T580 Version -
Lenovo ≫ Thinkpad X1 Tablet Gen 1 Firmware Version < n1let86w
   Lenovo ≫ Thinkpad X1 Tablet Gen 1 Version -
Lenovo ≫ Thinkpad X1 Tablet Gen 2 Firmware Version < n1oet50w
   Lenovo ≫ Thinkpad X1 Tablet Gen 2 Version -
Lenovo ≫ Thinkpad W540 Firmware Version < gnet92ww
   Lenovo ≫ Thinkpad W540 Version -
Lenovo ≫ Thinkpad W541 Firmware Version < gnet92ww
   Lenovo ≫ Thinkpad W541 Version -
Lenovo ≫ Thinkpad W550s Firmware Version < n11et50w
   Lenovo ≫ Thinkpad W550s Version -
Lenovo ≫ Thinkpad X1 Yoga Firmware Version < n1fet70w
   Lenovo ≫ Thinkpad X1 Yoga Version -
Lenovo ≫ Thinkpad X1 Yoga Gen 2 Firmware Version < n1net47w
   Lenovo ≫ Thinkpad X1 Yoga Gen 2 Version -
Lenovo ≫ Thinkpad X1 Yoga Gen 3 Firmware Version < n25et50w
   Lenovo ≫ Thinkpad X1 Yoga Gen 3 Version -
Lenovo ≫ Thinkpad X250 Firmware Version < n10et58w
   Lenovo ≫ Thinkpad X250 Version -
Lenovo ≫ Thinkpad X280 Firmware Version < n20et44w
   Lenovo ≫ Thinkpad X280 Version -
Lenovo ≫ Thinkpad X390 Firmware Version < n2let60w
   Lenovo ≫ Thinkpad X390 Version -
Lenovo ≫ Thinkpad 11e Yoga Firmware Version < n15et78w
   Lenovo ≫ Thinkpad 11e Yoga Version -
Lenovo ≫ Thinkpad Yoga 15 Firmware Version < n19et61w
   Lenovo ≫ Thinkpad Yoga 15 Version -
Lenovo ≫ Thinkpad Yoga 260 Firmware Version < n1get98w
   Lenovo ≫ Thinkpad Yoga 260 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.25% 0.163
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.7 0.8 5.9
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NIST 7.2 3.9 10
AV:L/AC:L/Au:N/C:C/I:C/A:C
Lenovo 6.7 0.8 5.9
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CWE-269 Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

https://support.lenovo.com/us/en/product_security/LEN-84943
Vendor Advisory