Lucene search

LenovoCVE-2021-3843

HistoryNov 12, 2021 - 10:15 p.m.

CVE-2021-3843

2021-11-1222:15:08

CWE-20

lenovo

web.nvd.nist.gov

vulnerability

smi

eeprom

thinkpad

cve-2021-3843

nvd

code execution

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

6.7

Confidence

High

EPSS

Percentile

5.1%

JSON

A potential vulnerability in the SMI function to access EEPROM in some ThinkPad models may allow an attacker with local access and elevated privileges to execute arbitrary code.

Affected configurations

Nvd

Node

lenovothinkpad_11e_3rd_gen_firmwareRange≤1.22braswell

AND

lenovothinkpad_11e_3rd_genMatch-

Node

lenovothinkpad_11e_3rd_gen_firmwareRange≤1.29skylate

AND

lenovothinkpad_11e_3rd_genMatch-

Node

lenovothinkpad_11e_4th_gen_i3_firmwareRange≤1.22

AND

lenovothinkpad_11e_4th_gen_i3Match-

Node

lenovothinkpad_11e_4th_gen_i7_firmwareRange≤1.22

AND

lenovothinkpad_11e_4th_gen_i7Match-

Node

lenovothinkpad_11e_4th_gen_i5_firmwareRange≤1.22

AND

lenovothinkpad_11e_4th_gen_i5Match-

Node

lenovothinkpad_11e_4th_gen_celeron_firmwareRange≤1.27

AND

lenovothinkpad_11e_4th_gen_celeronMatch-

Node

lenovothinkpad_11e_yoga_gen_6_firmwareRange≤1.12

AND

lenovothinkpad_11e_yoga_gen_6Match-

Node

lenovothinkpad_13_gen_2_firmwareRange≤1.29

AND

lenovothinkpad_13_gen_2Match-

Node

lenovothinkpad_l13_firmwareRange≤1.31

AND

lenovothinkpad_l13Match-

Node

lenovothinkpad_l13_gen_2_firmwareRange≤1.11non-vpro

AND

lenovothinkpad_l13_gen_2Match-

Node

lenovothinkpad_l13_gen_2_firmwareRange≤1.08vpro

AND

lenovothinkpad_l13_gen_2Match-

Node

lenovothinkpad_l13_yoga_firmwareRange≤1.31

AND

lenovothinkpad_l13_yogaMatch-

Node

lenovothinkpad_l13_yoga_gen_2_firmwareRange≤1.11non-vpro

AND

lenovothinkpad_l13_yoga_gen_2Match-

Node

lenovothinkpad_l13_yoga_gen_2_firmwareRange≤1.08vpro

AND

lenovothinkpad_l13_yoga_gen_2Match-

Node

lenovothinkpad_l14_gen_1_firmwareRange<1.15

AND

lenovothinkpad_l14_gen_1Match-

Node

lenovothinkpad_l14_firmwareRange<1.20.1.17

AND

lenovothinkpad_l14Match-

Node

lenovothinkpad_l15_gen_1_firmwareRange<1.15

AND

lenovothinkpad_l15_gen_1Match-

Node

lenovothinkpad_l15_firmwareRange<1.20.1.17

AND

lenovothinkpad_l15Match-

Node

lenovothinkpad_l380_firmwareRange≤1.26

AND

lenovothinkpad_l380Match-

Node

lenovothinkpad_l380_yoga_firmwareRange≤1.26

AND

lenovothinkpad_l380_yogaMatch-

Node

lenovothinkpad_l390_yoga_firmwareRange≤1.35

AND

lenovothinkpad_l390_yogaMatch-

Node

lenovothinkpad_l390_firmwareRange≤1.35

AND

lenovothinkpad_l390Match-

Node

lenovothinkpad_s5_2nd_gen_firmwareRange≤1.28

AND

lenovothinkpad_s5_2nd_genMatch-

Node

lenovothinkpad_t460_firmwareRange≤1.43.1.11

AND

lenovothinkpad_t460Match-

Node

lenovothinkpad_s2_gen_6_firmwareRange≤2021-09-30

AND

lenovothinkpad_s2_gen_6Match-

Node

lenovothinkpad_s2_yoga_gen_6_firmwareRange≤2021-09-30

AND

lenovothinkpad_s2_yoga_gen_6Match-

Node

lenovothinkpad_x12_detachable_gen_1_firmwareRange<1.16

AND

lenovothinkpad_x12_detachable_gen_1Match-

Node

lenovothinkpad_x260_firmwareRange≤1.47\/1.15

AND

lenovothinkpad_x260Match-

Node

lenovothinkpad_x380_yoga_firmwareRange≤1.34

AND

lenovothinkpad_x380_yogaMatch-

Node

lenovothinkpad_x390_yoga_firmwareRange<n2let87w

AND

lenovothinkpad_x390_yogaMatch-

Node

lenovothinkpad_11e_5th_gen_firmwareRange≤1.13

AND

lenovothinkpad_11e_5th_genMatch-

Node

lenovothinkpad_11e_5th_gen_firmwareRange≤1.13

AND

lenovothinkpad_yoga_370Match-

Node

lenovothinkpad_x1_fold_gen_1_firmwareRange<n2pet50w

AND

lenovothinkpad_x1_fold_gen_1Match-

VendorProductVersionCPE
lenovothinkpad_11e_3rd_gen_firmware*cpe:2.3:o:lenovo:thinkpad_11e_3rd_gen_firmware:*:*:*:*:braswell:*:*:*
lenovothinkpad_11e_3rd_gen-cpe:2.3:h:lenovo:thinkpad_11e_3rd_gen:-:*:*:*:*:*:*:*
lenovothinkpad_11e_3rd_gen_firmware*cpe:2.3:o:lenovo:thinkpad_11e_3rd_gen_firmware:*:*:*:*:skylate:*:*:*
lenovothinkpad_11e_4th_gen_i3_firmware*cpe:2.3:o:lenovo:thinkpad_11e_4th_gen_i3_firmware:*:*:*:*:*:*:*:*
lenovothinkpad_11e_4th_gen_i3-cpe:2.3:h:lenovo:thinkpad_11e_4th_gen_i3:-:*:*:*:*:*:*:*
lenovothinkpad_11e_4th_gen_i7_firmware*cpe:2.3:o:lenovo:thinkpad_11e_4th_gen_i7_firmware:*:*:*:*:*:*:*:*
lenovothinkpad_11e_4th_gen_i7-cpe:2.3:h:lenovo:thinkpad_11e_4th_gen_i7:-:*:*:*:*:*:*:*
lenovothinkpad_11e_4th_gen_i5_firmware*cpe:2.3:o:lenovo:thinkpad_11e_4th_gen_i5_firmware:*:*:*:*:*:*:*:*
lenovothinkpad_11e_4th_gen_i5-cpe:2.3:h:lenovo:thinkpad_11e_4th_gen_i5:-:*:*:*:*:*:*:*
lenovothinkpad_11e_4th_gen_celeron_firmware*cpe:2.3:o:lenovo:thinkpad_11e_4th_gen_celeron_firmware:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
lenovo	thinkpad_11e_3rd_gen_firmware	*	cpe:2.3:o:lenovo:thinkpad_11e_3rd_gen_firmware:::::braswell:::*
lenovo	thinkpad_11e_3rd_gen	-	cpe:2.3:h:lenovo:thinkpad_11e_3rd_gen:-:::::::*
lenovo	thinkpad_11e_3rd_gen_firmware	*	cpe:2.3:o:lenovo:thinkpad_11e_3rd_gen_firmware:::::skylate:::*
lenovo	thinkpad_11e_4th_gen_i3_firmware	*	cpe:2.3:o:lenovo:thinkpad_11e_4th_gen_i3_firmware::::::::
lenovo	thinkpad_11e_4th_gen_i3	-	cpe:2.3:h:lenovo:thinkpad_11e_4th_gen_i3:-:::::::*
lenovo	thinkpad_11e_4th_gen_i7_firmware	*	cpe:2.3:o:lenovo:thinkpad_11e_4th_gen_i7_firmware::::::::
lenovo	thinkpad_11e_4th_gen_i7	-	cpe:2.3:h:lenovo:thinkpad_11e_4th_gen_i7:-:::::::*
lenovo	thinkpad_11e_4th_gen_i5_firmware	*	cpe:2.3:o:lenovo:thinkpad_11e_4th_gen_i5_firmware::::::::
lenovo	thinkpad_11e_4th_gen_i5	-	cpe:2.3:h:lenovo:thinkpad_11e_4th_gen_i5:-:::::::*
lenovo	thinkpad_11e_4th_gen_celeron_firmware	*	cpe:2.3:o:lenovo:thinkpad_11e_4th_gen_celeron_firmware::::::::

Rows per page:

1-10 of 621

CNA Affected

[
  {
    "product": "ThinkPad BIOS",
    "vendor": "Lenovo",
    "versions": [
      {
        "status": "affected",
        "version": "various"
      }
    ]
  }
]

References

support.lenovo.com/us/en/product_security/LEN-72619

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

6.7

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVE-2021-3843