Lucene search

LenovoCVE-2021-3719

HistoryNov 12, 2021 - 10:15 p.m.

CVE-2021-3719

2021-11-1222:15:07

CWE-20

lenovo

web.nvd.nist.gov

cve-2021-3719

vulnerability

smi callback function

thinkcentre

thinkstation

local access

elevated privileges

arbitrary code

nvd

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

6.7

Confidence

High

EPSS

Percentile

5.1%

JSON

A potential vulnerability in the SMI callback function that saves and restore boot script tables used for resuming from sleep state in some ThinkCentre and ThinkStation models may allow an attacker with local access and elevated privileges to execute arbitrary code.

Affected configurations

Nvd

Node

lenovothinkcentre_e93_firmwareRange<fbktdfa

AND

lenovothinkcentre_e93Match-

Node

lenovothinkcentre_m600_firmwareRange<m00kt65a

AND

lenovothinkcentre_m600Match-

Node

lenovothinkcentre_m700_tiny_firmwareRange<fwktb9a

AND

lenovothinkcentre_m700_tinyMatch-

Node

lenovothinkcentre_m73_firmwareRange<fhkt86a

AND

lenovothinkcentre_m73Match-

Node

lenovothinkcentre_m73p_firmwareRange<fbktdfa

AND

lenovothinkcentre_m73pMatch-

Node

lenovothinkcentre_m800_firmwareRange<fwktb9a

AND

lenovothinkcentre_m800Match-

Node

lenovothinkcentre_m818z_firmwareRange<m1ekt23a

AND

lenovothinkcentre_m818zMatch-

Node

lenovothinkcentre_m83_firmwareRange<fbktdfa

AND

lenovothinkcentre_m83Match-

Node

lenovothinkcentre_m900_firmwareRange<fwktb9a

AND

lenovothinkcentre_m900Match-

Node

lenovothinkcentre_m900x_firmwareRange<fwktb9a

AND

lenovothinkcentre_m900xMatch-

Node

lenovothinkcentre_m93_firmwareRange<fbktdfa

AND

lenovothinkcentre_m93Match-

Node

lenovothinkcentre_m93p_firmwareRange<fbktdfa

AND

lenovothinkcentre_m93pMatch-

Node

lenovothinkcentre_m4500q_firmwareRange<fhkt86a

AND

lenovothinkcentre_m4500qMatch-

Node

lenovothinkcentre_m6500t\/s_firmwareRange<fbktdfa

AND

lenovothinkcentre_m6500t\/sMatch-

Node

lenovothinkcentre_m8500t\/s_firmwareRange<fbktdfa

AND

lenovothinkcentre_m8500t\/sMatch-

Node

lenovothinkcentre_x1_firmwareRange<m0hkt50a

AND

lenovothinkcentre_x1Match-

Node

lenovothinkstation_p300_firmwareRange<fbktdfa

AND

lenovothinkstation_p300Match-

Node

lenovothinkstation_p500_firmwareRange<a4ktaba

AND

lenovothinkstation_p500Match-

Node

lenovothinkstation_p700_firmwareRange<a5ktaba

AND

lenovothinkstation_p700Match-

Node

lenovothinkstation_p900_firmwareRange<a6ktaba

AND

lenovothinkstation_p900Match-

VendorProductVersionCPE
lenovothinkcentre_e93_firmware*cpe:2.3:o:lenovo:thinkcentre_e93_firmware:*:*:*:*:*:*:*:*
lenovothinkcentre_e93-cpe:2.3:h:lenovo:thinkcentre_e93:-:*:*:*:*:*:*:*
lenovothinkcentre_m600_firmware*cpe:2.3:o:lenovo:thinkcentre_m600_firmware:*:*:*:*:*:*:*:*
lenovothinkcentre_m600-cpe:2.3:h:lenovo:thinkcentre_m600:-:*:*:*:*:*:*:*
lenovothinkcentre_m700_tiny_firmware*cpe:2.3:o:lenovo:thinkcentre_m700_tiny_firmware:*:*:*:*:*:*:*:*
lenovothinkcentre_m700_tiny-cpe:2.3:h:lenovo:thinkcentre_m700_tiny:-:*:*:*:*:*:*:*
lenovothinkcentre_m73_firmware*cpe:2.3:o:lenovo:thinkcentre_m73_firmware:*:*:*:*:*:*:*:*
lenovothinkcentre_m73-cpe:2.3:h:lenovo:thinkcentre_m73:-:*:*:*:*:*:*:*
lenovothinkcentre_m73p_firmware*cpe:2.3:o:lenovo:thinkcentre_m73p_firmware:*:*:*:*:*:*:*:*
lenovothinkcentre_m73p-cpe:2.3:h:lenovo:thinkcentre_m73p:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
lenovo	thinkcentre_e93_firmware	*	cpe:2.3:o:lenovo:thinkcentre_e93_firmware::::::::
lenovo	thinkcentre_e93	-	cpe:2.3:h:lenovo:thinkcentre_e93:-:::::::*
lenovo	thinkcentre_m600_firmware	*	cpe:2.3:o:lenovo:thinkcentre_m600_firmware::::::::
lenovo	thinkcentre_m600	-	cpe:2.3:h:lenovo:thinkcentre_m600:-:::::::*
lenovo	thinkcentre_m700_tiny_firmware	*	cpe:2.3:o:lenovo:thinkcentre_m700_tiny_firmware::::::::
lenovo	thinkcentre_m700_tiny	-	cpe:2.3:h:lenovo:thinkcentre_m700_tiny:-:::::::*
lenovo	thinkcentre_m73_firmware	*	cpe:2.3:o:lenovo:thinkcentre_m73_firmware::::::::
lenovo	thinkcentre_m73	-	cpe:2.3:h:lenovo:thinkcentre_m73:-:::::::*
lenovo	thinkcentre_m73p_firmware	*	cpe:2.3:o:lenovo:thinkcentre_m73p_firmware::::::::
lenovo	thinkcentre_m73p	-	cpe:2.3:h:lenovo:thinkcentre_m73p:-:::::::*

Rows per page:

1-10 of 401

CNA Affected

[
  {
    "product": "ThinkCentre and ThinkStation BIOS",
    "vendor": "Lenovo",
    "versions": [
      {
        "status": "affected",
        "version": "various"
      }
    ]
  }
]

References

support.lenovo.com/us/en/product_security/LEN-67440

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

6.7

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVE-2021-3719