Security restrictions bypass in Lenovo products - CVE-2022-1107

Vulnerability identifier: #VU62282

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-1107

CWE-ID: CWE-264

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to usage of Boot Services in the SmmOEMInt15 SMI handler. A local user can bypass implemented security restrictions and execute arbitrary code with elevated privileges.

ThinkPad X1 Tablet 1st Gen 20GG
ThinkPad X1 Yoga 1st Gen 20FQ
ThinkPad X1 Carbon 4th Gen 20FC
ThinkPad X1 Carbon 4th Gen 20FB
ThinkPad X1 Yoga 1st Gen 20FR
ThinkPad Yoga 260
ThinkPad L560
ThinkPad T560
ThinkPad P50s
ThinkPad X1 Tablet 1st Gen 20GH
ThinkPad X1 Carbon 5th Gen - Skylake 20K3
ThinkPad X1 Carbon 5th Gen - Kabylake 20HR
ThinkPad X1 Carbon 5th Gen - Kabylake 20HQ
ThinkPad X1 Carbon 5th Gen - Skylake 20K4
ThinkPad X1 Yoga 2nd Gen 20JG
ThinkPad X1 Yoga 2nd Gen 20JF
ThinkPad X1 Yoga 2nd Gen 20JE
ThinkPad X1 Yoga 2nd Gen 20JD
ThinkPad X1 Tablet 2nd Gen 20JB
ThinkPad X1 Tablet 2nd Gen 20JC
ThinkPad P51s 20K0
ThinkPad P51s 20JY
ThinkPad P51s 20HC
ThinkPad P51s 20HB
ThinkPad T570 20H9
ThinkPad T570 20HA
ThinkPad T570 20JW
ThinkPad T570 20JX
ThinkPad L570 20JQ
ThinkPad L570 20J8
ThinkPad L570 20JR
ThinkPad L570 20J9
ThinkPad X390 Yoga
ThinkPad X250
ThinkPad T550
ThinkPad W550s
ThinkPad X1 Carbon 3rd Gen 20BS
ThinkPad X1 Carbon 3rd Gen 20BT
ThinkPad Yoga 11e 20D9
ThinkPad Yoga 11e 20DA
ThinkPad 11e 20DA
ThinkPad 11e 20D9
ThinkPad Helix 20CG
ThinkPad Helix 20CH
ThinkPad Yoga 15
ThinkPad X280 20KE
ThinkPad X280 20KF
ThinkPad X1 Yoga 3rd Gen 20LG
ThinkPad X1 Yoga 3rd Gen 20LF
ThinkPad X1 Yoga 3rd Gen 20LE
ThinkPad X1 Yoga 3rd Gen 20LD
ThinkPad P52s 20LC
ThinkPad P52s 20LB
ThinkPad T580 20L9
ThinkPad T580 20LA
ThinkPad W541
ThinkPad W540
ThinkPad S540

Install updates from vendor's website.

ThinkPad X1 Tablet 1st Gen 20GG - update to N1LE T86W
ThinkPad X1 Yoga 1st Gen 20FQ - update to N1FET70W
ThinkPad X1 Carbon 4th Gen 20FC - update to N1FET70W
ThinkPad X1 Carbon 4th Gen 20FB - update to N1FET70W
ThinkPad X1 Yoga 1st Gen 20FR - update to N1FET70W
ThinkPad Yoga 260 - update to N1GET98W
ThinkPad L560 - update to N1HET85W
ThinkPad T560 - update to N1KET46W
ThinkPad P50s - update to N1KET46W
ThinkPad X1 Tablet 1st Gen 20GH - update to N1LET86W
ThinkPad X1 Carbon 5th Gen - Skylake 20K3 - update to N1MET55W
ThinkPad X1 Carbon 5th Gen - Kabylake 20HR - update to N1MET55W
ThinkPad X1 Carbon 5th Gen - Kabylake 20HQ - update to N1MET55W
ThinkPad X1 Carbon 5th Gen - Skylake 20K4 - update to N1MET55W
ThinkPad X1 Yoga 2nd Gen 20JG - update to N1NET47W
ThinkPad X1 Yoga 2nd Gen 20JF - update to N1NET47W
ThinkPad X1 Yoga 2nd Gen 20JE - update to N1NET47W
ThinkPad X1 Yoga 2nd Gen 20JD - update to N1NET47W
ThinkPad X1 Tablet 2nd Gen 20JB - update to N1OET50W
ThinkPad X1 Tablet 2nd Gen 20JC - update to N1OET50W
ThinkPad P51s 20K0 - update to N1VET50W
ThinkPad P51s 20JY - update to N1VET50W
ThinkPad P51s 20HC - update to N1VET50W
ThinkPad P51s 20HB - update to N1VET50W
ThinkPad T570 20H9 - update to N1VET50W
ThinkPad T570 20HA - update to N1VET50W
ThinkPad T570 20JW - update to N1VET50W
ThinkPad T570 20JX - update to N1VET50W
ThinkPad L570 20JQ - update to N1XET65W
ThinkPad L570 20J8 - update to N1XET65W
ThinkPad L570 20JR - update to N1XET65W
ThinkPad L570 20J9 - update to N1XET65W
ThinkPad X390 Yoga - update to N2LET60W
ThinkPad X250 - update to N10ET58W
ThinkPad T550 - update to N11ET50W
ThinkPad W550s - update to N11ET50W
ThinkPad X1 Carbon 3rd Gen 20BS - update to N14ET52 W
ThinkPad X1 Carbon 3rd Gen 20BT - update to N14ET52W
ThinkPad Yoga 11e 20D9 - update to N15ET78W
ThinkPad Yoga 11e 20DA - update to N15ET78W
ThinkPad 11e 20DA - update to N15ET78W
ThinkPad 11e 20D9 - update to N15ET78W
ThinkPad Helix 20CG - update to N17ETA8W
ThinkPad Helix 20CH - update to N17ETA8W
ThinkPad Yoga 15 - update to N19ET61W
ThinkPad X280 20KE - update to N20ET44W
ThinkPad X280 20KF - update to N20ET44W
ThinkPad X1 Yoga 3rd Gen 20LG - update to N25ET50W
ThinkPad X1 Yoga 3rd Gen 20LF - update to N25ET50W
ThinkPad X1 Yoga 3rd Gen 20LE - update to N25ET50W
ThinkPad X1 Yoga 3rd Gen 20LD - update to N25ET50W
ThinkPad P52s 20LC - update to N27ET36W
ThinkPad P52s 20LB - update to N27ET36W
ThinkPad T580 20L9 - update to N27ET36W
ThinkPad T580 20LA - update to N27ET36W
ThinkPad W541 - update to GNET92WW
ThinkPad W540 - update to GNET92WW
ThinkPad S540 - update to GPET80WW

• https://support.lenovo.com/lu/uk/product_security/LEN-84943

• Multiple vulnerabilities in Lenovo ThinkPad BIOS