Code injection

2019-11-1221:15:00

PRIOn knowledge base

www.prio-n.com

6.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

12.7%

JSON

A potential vulnerability in the SMI callback function used in Legacy USB driver using passed parameter without sufficient checking in some Lenovo ThinkPad models may allow arbitrary code execution.

CPENameOperatorVersion
thinkpad_helix_firmwareeq< gfet65ww
thinkpad_s531_firmwareeq< gket46ww
thinkpad_t440_firmwareeq< gjeta3ww
thinkpad_t440p_firmwareeq< gleta0ww
thinkpad_t440s_firmwareeq< gjeta3ww
thinkpad_t540p_firmwareeq< gmet89ww
thinkpad_w540_firmwareeq< gnet92ww
thinkpad_w541_firmwareeq< gnet92ww
thinkpad_x240_firmwareeq< giet98ww
thinkpad_x240s_firmwareeq< giet98ww

Name	Operator	Version
thinkpad_helix_firmware	eq	< gfet65ww
thinkpad_s531_firmware	eq	< gket46ww
thinkpad_t440_firmware	eq	< gjeta3ww
thinkpad_t440p_firmware	eq	< gleta0ww
thinkpad_t440s_firmware	eq	< gjeta3ww
thinkpad_t540p_firmware	eq	< gmet89ww
thinkpad_w540_firmware	eq	< gnet92ww
thinkpad_w541_firmware	eq	< gnet92ww
thinkpad_x240_firmware	eq	< giet98ww
thinkpad_x240s_firmware	eq	< giet98ww

References

support.lenovo.com/us/en/product_security/LEN-27714