CVE-2022-24418

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM...

CVE-2022-24417

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM...

CVE-2021-39298

A potential vulnerability in AMD System Management Mode SMM interrupt handler may allow an attacker with high privileges to access the SMM resulting in arbitrary code execution which could be used by malicious actors to bypass security mechanisms provided in the UEFI firmware...

CVE-2022-28806

An issue was discovered on certain Fujitsu LIEFBOOK devices A3510, U9310, U7511/U7411/U7311, U9311, E5510/E5410, U7510/U7410/U7310, E459/E449 with BIOS versions before v1.09 A3510, v2.17 U9310, v2.30 U7511/U7411/U7311, v2.33 U9311, v2.23 E5510, v2.19 U7510/U7410, v2.13 U7310, and v1.09 E459/E449...

FUJITSU LIEFBOOK devices: Buffer error vulnerabilities

The FUJITSU LIEFBOOK devices are a laptop computer from Fujitsu FUJITSU Japan. A buffer error vulnerability exists in multiple versions of FUJITSU LIEFBOOK, which stems from the FJGABIFlashCoreAxtractionSMM driver registering a Software System Management Interrupt SWSMI handler that is not...

GSD-2022-1001821 ice: fix 'scheduling while atomic' on aux critical err interrupt

ice: fix 'scheduling while atomic' on aux critical err interrupt This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.33 by commit...

PT-2022-30091

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.15 through v5.15.32 Description A potential issue exists in the Linux Kernel's ethernet driver, specifically in the cpsw component, which could lead to a panic when interrupt coalescing is set via ethtool. The actual...

PT-2022-30094

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.33 Description The issue is related to a 'scheduling while atomic' error on aux critical err interrupt. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...

PT-2022-29779

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.16.19 Description The issue is related to a 'scheduling while atomic' error on aux critical err interrupt. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...

PT-2022-29459

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.17.2 Description A potential issue exists in the Linux Kernel's ethernet driver, specifically in the cpsw component, which could lead to a panic when interrupt coalescing is set via ethtool. The actual impact...

PT-2022-29460

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.17.2 Description The issue is related to a 'scheduling while atomic' error on aux critical err interrupt. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...

PT-2022-29471

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.17.2 Description The issue is related to a kernel oops in the btmtksdio interrupt function. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior t...

PT-2022-29777

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.16.19 Description A potential issue exists in the Linux Kernel, specifically in the ethernet cpsw driver, where a panic can occur when interrupt coalescing is set via ethtool. The actual impact and attack...

CVE-2021-4212

A potential vulnerability in the SMI callback function used in the Legacy BIOS mode driver in some Lenovo Notebook models may allow an attacker with local access and elevated privileges to execute arbitrary code...

CVE-2021-4210

A potential vulnerability in the SMI callback function used in the NVME driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow an attacker with local access and elevated privileges to execute arbitrary code...

Lenovo Variable SMI Privilege Escalation

The vulnerability of Lenovo’s SMI microprogramming software for BIOS on Lenovo laptops lies in the ability to pass the physical address of a specially created buffer as a parameter to the SMI handler. Exploiting this vulnerability can allow an attacker to enhance their privileges and execute...

Lenovo Notebook: Input validation error vulnerability

Lenovo Notebook is a laptop computer from Lenovo, a Chinese company. The Lenovo Notebook suffers from an input validation error vulnerability that exists due to insufficient validation of user-supplied input in the LenovoVariable SMI handler. A local user can run a specially crafted program to...

LenovoFlashDeviceInterface SMI Code Execution

The vulnerability of the LenovoFlashDeviceInterface interface in the System Management Interrupt SMI handling of BIOS microprogramming systems in ThinkPad laptops is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability allows an attacker to execute...

Lenovo ThinkPad buffer error vulnerability

Lenovo ThinkPad is a portable computer from Lenovo, a Chinese company. The Lenovo ThinkPad BIOS suffers from a buffer error vulnerability that originates from a boundary error in the LenovoFlashDeviceInterface within the SMI handler. A local attacker could run a specially crafted program to trigg...

Lenovo ThinkPad permission licensing and access control vulnerabilities

Lenovo ThinkPad is a portable computer from Lenovo, a Chinese company. The Lenovo ThinkPad BIOS is vulnerable to a privilege-granting and access-control issue that arises from the use of boot services in the SmmOEMInt15 SMI handler. A local attacker could bypass implemented security restrictions...