Code injection

2021-11-1222:15:00

PRIOn knowledge base

www.prio-n.com

5.4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

12.8%

JSON

A potential vulnerability in the SMI callback function used in CSME configuration of some Lenovo Notebook and ThinkPad systems could be used to leak out data out of the SMRAM range.

CPENameOperatorVersion
ideapad_s940-14iwl_firmwarele12.0.81.1753
ideapad_yoga_s940-14iwl_firmwarele12.0.81.1753
thinkpad_10_firmwareeq< 20211025
thinkpad_11e_3rd_gen_firmwareeq< 20211031
thinkpad_11e_4th_gen_firmwareeq< 20211031
thinkpad_11e_yoga_gen_6_firmwareeq< 20211031
thinkpad_13_gen_2_firmwareeq< 20211031
thinkpad_25_firmwareeq< n1qet92w
thinkpad_e14_firmwareeq<= 20211015
thinkpad_e14_gen_2_firmwareeq< 20211015

Name	Operator	Version
ideapad_s940-14iwl_firmware	le	12.0.81.1753
ideapad_yoga_s940-14iwl_firmware	le	12.0.81.1753
thinkpad_10_firmware	eq	< 20211025
thinkpad_11e_3rd_gen_firmware	eq	< 20211031
thinkpad_11e_4th_gen_firmware	eq	< 20211031
thinkpad_11e_yoga_gen_6_firmware	eq	< 20211031
thinkpad_13_gen_2_firmware	eq	< 20211031
thinkpad_25_firmware	eq	< n1qet92w
thinkpad_e14_firmware	eq	<= 20211015
thinkpad_e14_gen_2_firmware	eq	< 20211015