Multiple vulnerabilities in Lenovo ThinkPad BIOS

1) Buffer overflow

EUVDB-ID: #VU62281

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-1108

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error in LenovoFlashDeviceInterface within the SMI handler. A local user can run a specially crafted program to trigger memory corruption and execute arbitrary code with elevated privileges.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

ThinkPad X1 Fold Gen 1 20RK: before N2PET50W

ThinkPad X1 Fold Gen 1 20RL: before N2PET50W

External links

http://support.lenovo.com/lu/uk/product_security/LEN-84943

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Security restrictions bypass

EUVDB-ID: #VU62282

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-1107

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to usage of Boot Services in the SmmOEMInt15 SMI handler. A local user can bypass implemented security restrictions and execute arbitrary code with elevated privileges.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

ThinkPad 11e 20D9: before N15ET78W

ThinkPad 11e 20DA: before N15ET78W

ThinkPad Helix 20CG: before N17ETA8W

ThinkPad Helix 20CH: before N17ETA8W

ThinkPad L560: before N1HET85W

ThinkPad L570 20J8: before N1XET65W

ThinkPad L570 20J9: before N1XET65W

ThinkPad L570 20JQ: before N1XET65W

ThinkPad L570 20JR: before N1XET65W

ThinkPad P50s: before N1KET46W

ThinkPad P51s 20HB: before N1VET50W

ThinkPad P51s 20HC: before N1VET50W

ThinkPad P51s 20JY: before N1VET50W

ThinkPad P51s 20K0: before N1VET50W

ThinkPad P52s 20LB: before N27ET36W

ThinkPad P52s 20LC: before N27ET36W

ThinkPad S540: before GPET80WW

ThinkPad T550: before N11ET50W

ThinkPad T560: before N1KET46W

ThinkPad T570 20H9: before N1VET50W

ThinkPad T570 20HA: before N1VET50W

ThinkPad T570 20JW: before N1VET50W

ThinkPad T570 20JX: before N1VET50W

ThinkPad T580 20L9: before N27ET36W

ThinkPad T580 20LA: before N27ET36W

ThinkPad X1 Tablet 1st Gen 20GG: before N1LE T86W

ThinkPad X1 Tablet 1st Gen 20GH: before N1LET86W

ThinkPad X1 Tablet 2nd Gen 20JB: before N1OET50W

ThinkPad X1 Tablet 2nd Gen 20JC: before N1OET50W

ThinkPad W540: before GNET92WW

ThinkPad W541: before GNET92WW

ThinkPad W550s: before N11ET50W

ThinkPad X1 Carbon 3rd Gen 20BS: before N14ET52 W

ThinkPad X1 Carbon 3rd Gen 20BT: before N14ET52W

ThinkPad X1 Carbon 4th Gen 20FB: before N1FET70W

ThinkPad X1 Carbon 4th Gen 20FC: before N1FET70W

ThinkPad X1 Carbon 5th Gen - Kabylake 20HR: before N1MET55W

ThinkPad X1 Carbon 5th Gen - Kabylake 20HQ: before N1MET55W

ThinkPad X1 Carbon 5th Gen - Skylake 20K4: before N1MET55W

ThinkPad X1 Carbon 5th Gen - Skylake 20K3: before N1MET55W

ThinkPad X1 Yoga 1st Gen 20FQ: before N1FET70W

ThinkPad X1 Yoga 1st Gen 20FR: before N1FET70W

ThinkPad X1 Yoga 2nd Gen 20JD: before N1NET47W

ThinkPad X1 Yoga 2nd Gen 2 0JE: before N1NET47W

ThinkPad X1 Yoga 2nd Gen 20JF: before N1NET47W

ThinkPad X1 Yoga 2nd Gen 20JG: before N1NET47W

ThinkPad X1 Yoga 3rd Gen 20LD: before N25ET50W

ThinkPad X1 Yoga 3rd Gen 20LE: before N25ET50W

ThinkPad X1 Yoga 3rd Gen 20LF: before N25ET50W

ThinkPad X1 Yoga 3rd Gen 20LG: before N25ET50W

ThinkPad X250: before N10ET58W

ThinkPad X280 20KF: before N20ET44W

ThinkPad X280 20KE: before N20ET44W

ThinkPad X390 Yoga: before N2LET60W

ThinkPad Yoga 11e 20D9: before N15ET78W

ThinkPad Yoga 11e 20DA: before N15ET78W

ThinkPad Yoga 15: before N19ET61W

ThinkPad Yoga 260: before N1GET98W

External links

http://support.lenovo.com/lu/uk/product_security/LEN-84943

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.