CVE-2022-1107 | Severity.io

Description

During an internal product security audit a potential vulnerability due to use of Boot Services in the SmmOEMInt15 SMI handler was discovered in some ThinkPad models could be exploited by an attacker with elevated privileges that could allow for execution of code.

Related CPE's

thinkpad_11e_firmware

Vulnerable

thinkpad_helix_firmware

Vulnerable

thinkpad_l560_firmware

Vulnerable

thinkpad_l570_firmware

Vulnerable

thinkpad_p50s_firmware

Vulnerable

thinkpad_p51s_firmware

Vulnerable

thinkpad_p52s_firmware

Vulnerable

thinkpad_s540_firmware

Vulnerable

thinkpad_t550_firmware

Vulnerable

thinkpad_t560_firmware

Vulnerable

thinkpad_t570_firmware

Vulnerable

thinkpad_t580_firmware

Vulnerable

thinkpad_x1_tablet_gen_1_firmware

Vulnerable

thinkpad_x1_tablet_gen_1

thinkpad_x1_tablet_gen_2_firmware

Vulnerable

thinkpad_x1_tablet_gen_2

thinkpad_w540_firmware

Vulnerable

thinkpad_w541_firmware

Vulnerable

thinkpad_w550s_firmware

Vulnerable

thinkpad_x1_carbon_3rd_gen_firmware

Vulnerable

thinkpad_x1_carbon_3rd_gen

thinkpad_x1_carbon_4th_gen_firmware

Vulnerable

thinkpad_x1_carbon_4th_gen

thinkpad_x1_carbon_5th_gen_kabylake_firmware

Vulnerable

thinkpad_x1_carbon_5th_gen_kabylake

thinkpad_x1_carbon_5th_gen_skylake_firmware

Vulnerable

thinkpad_x1_carbon_5th_gen_skylake

thinkpad_x1_yoga_firmware

Vulnerable

thinkpad_x1_yoga

thinkpad_x1_yoga_gen_2_firmware

Vulnerable

thinkpad_x1_yoga_gen_2

thinkpad_x1_yoga_gen_3_firmware

Vulnerable

thinkpad_x1_yoga_gen_3

thinkpad_x250_firmware

Vulnerable

thinkpad_x280_firmware

Vulnerable

thinkpad_x390_firmware

Vulnerable

thinkpad_11e_yoga_firmware

Vulnerable

thinkpad_11e_yoga

thinkpad_yoga_15_firmware

Vulnerable

thinkpad_yoga_15

thinkpad_yoga_260_firmware

Vulnerable

thinkpad_yoga_260

References

https://support.lenovo.com/us/en/product_security/LEN-84943

Vendor Advisory

Weaknesses

[email protected]

Primary

CWE-20CWE-269

[email protected]

Secondary

CWE-20

CVSS impact metrics

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

6.7 · Medium

CVSS V3.1
CVSS V3.0
CVSS V2.0

Information

Source identifier

[email protected]

Vulnerability status

Analyzed

Published

2022-04-22T21:15:10.300

3 years ago

Last modified

2022-05-12T13:42:48.583

2 years ago