Permissions, Privileges, and Access Controls in Lenovo products - CVE-2022-3745
Published: November 1, 2022
Vulnerability identifier: #VU68893
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-3745
CWE-ID: CWE-264
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists in LCFC BIOS due to improperly imposed security restrictions. A local user can view incoming and returned data from SMI.
Affected software
Lenovo V14 G2-ITL
IdeaPad Yoga 7 16IAP7
Yoga 7 16IAH7
Yoga 7 14IAL7
Lenovo V17-IIL
Lenovo V17 G2-ITL
Lenovo V15-IGL
Lenovo V15 G2-ITL
Lenovo V15 G1-IML
Lenovo V14-IGL
ideapad Yoga 7-14ITL5
Lenovo V14 G1-IML
ThinkBook 15P G2 ITH
ideapad S540-13ITL
Lenovo V17 G3 IAP
Lenovo V15 G3 IAP
Lenovo V15 G2 IJL
Lenovo V14 G3 IAP
Lenovo V14 G2 IJL
ideapad 3-14ITL6
ideapad Gaming 3-15IMH05
ideapad Creator 5-15IMH05
ideapad 5-15IIL05
ideapad 3-17IML05
ideapad 3-15ITL6
ideapad 3-15ITL05
ideapad 3-15IML05
ideapad 3-15IIL05
Lenovo ThinkBook 15p IMH
ideapad 3-14ITL05
ideapad 3-14IML05
ideapad 3-14IIL05
ideapad 3-14IGL05
IdeaPad Yoga Slim 7 Pro 14IAP7
Yoga Slim 7 Pro 14IAH7
Yoga Slim 7 Carbon 13IAP7
ideapad Yoga 7-15ITL5
IdeaPad 3-15IGL05
Lenovo Legion 5 Pro 16IAH7H
Lenovo Legion 5 Pro 16IAH7
Lenovo Legion 5 15IAH7H
Lenovo Legion 5 15IAH7
ideapad L3-15ITL6
ideapad L3-15IML05
IdeaPad 5 15IAL7
IdeaPad 3-17ITL6
IdeaPad 3-17IIL05
Lenovo Legion 5 Pro-16ITH6
IdeaPad 3 17IAU7
IdeaPad 3 15IAU7
IdeaPad 3 14IAU7
IdeaPad 1-15IJL7
IdeaPad 1-14IJL7
IdeaPad 1 15IGL7
IdeaPad 1 15IAU7
IdeaPad 1 14IGL7
Lenovo Legion 5-17ITH6
Lenovo Slim 7 Carbon 13IAP7
Lenovo Slim 7 14IAP7
Lenovo S14 G3 IAP
Lenovo S14 G2 ITL
Lenovo Legion 7-16ITHg6
Lenovo Legion 5P-15IMH05H
Lenovo Legion 5P-15IMH05
Lenovo Legion 5-17ITH6H
IdeaPad 1 14IAU7
Lenovo Legion 5-17IMH05H
Lenovo Legion 5-17IMH05
Lenovo Legion 5-15ITH6H
Lenovo Legion 5-15ITH6
Lenovo Legion 5-15IMH6
Lenovo Legion 5-15IMH05H
Lenovo Legion 5-15IMH05
Lenovo Legion 5 Pro-16ITH6H
IdeaPad Yoga 9 14IAP7
IdeaPad Yoga 7 16IAP7
Yoga 7 16IAH7
Yoga 7 14IAL7
Lenovo V17-IIL
Lenovo V17 G2-ITL
Lenovo V15-IGL
Lenovo V15 G2-ITL
Lenovo V15 G1-IML
Lenovo V14-IGL
ideapad Yoga 7-14ITL5
Lenovo V14 G1-IML
ThinkBook 15P G2 ITH
ideapad S540-13ITL
Lenovo V17 G3 IAP
Lenovo V15 G3 IAP
Lenovo V15 G2 IJL
Lenovo V14 G3 IAP
Lenovo V14 G2 IJL
ideapad 3-14ITL6
ideapad Gaming 3-15IMH05
ideapad Creator 5-15IMH05
ideapad 5-15IIL05
ideapad 3-17IML05
ideapad 3-15ITL6
ideapad 3-15ITL05
ideapad 3-15IML05
ideapad 3-15IIL05
Lenovo ThinkBook 15p IMH
ideapad 3-14ITL05
ideapad 3-14IML05
ideapad 3-14IIL05
ideapad 3-14IGL05
IdeaPad Yoga Slim 7 Pro 14IAP7
Yoga Slim 7 Pro 14IAH7
Yoga Slim 7 Carbon 13IAP7
ideapad Yoga 7-15ITL5
IdeaPad 3-15IGL05
Lenovo Legion 5 Pro 16IAH7H
Lenovo Legion 5 Pro 16IAH7
Lenovo Legion 5 15IAH7H
Lenovo Legion 5 15IAH7
ideapad L3-15ITL6
ideapad L3-15IML05
IdeaPad 5 15IAL7
IdeaPad 3-17ITL6
IdeaPad 3-17IIL05
Lenovo Legion 5 Pro-16ITH6
IdeaPad 3 17IAU7
IdeaPad 3 15IAU7
IdeaPad 3 14IAU7
IdeaPad 1-15IJL7
IdeaPad 1-14IJL7
IdeaPad 1 15IGL7
IdeaPad 1 15IAU7
IdeaPad 1 14IGL7
Lenovo Legion 5-17ITH6
Lenovo Slim 7 Carbon 13IAP7
Lenovo Slim 7 14IAP7
Lenovo S14 G3 IAP
Lenovo S14 G2 ITL
Lenovo Legion 7-16ITHg6
Lenovo Legion 5P-15IMH05H
Lenovo Legion 5P-15IMH05
Lenovo Legion 5-17ITH6H
IdeaPad 1 14IAU7
Lenovo Legion 5-17IMH05H
Lenovo Legion 5-17IMH05
Lenovo Legion 5-15ITH6H
Lenovo Legion 5-15ITH6
Lenovo Legion 5-15IMH6
Lenovo Legion 5-15IMH05H
Lenovo Legion 5-15IMH05
Lenovo Legion 5 Pro-16ITH6H
IdeaPad Yoga 9 14IAP7
How to mitigate CVE-2022-3745
Install updates from vendor's website.
IdeaPad Yoga 9 14IAP7 - update to HNCN42WW