Input validation error in Lenovo products - CVE-2022-48189

Vulnerability identifier: #VU73735

CSH Severity: Low

CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2022-48189

CWE-ID: CWE-20

Exploitation vector: Local access

Exploit availability: No public exploit available

Vulnerable software:
20TQ
ThinkPad L13 Gen 2 20VH s
ThinkPad L13 Gen 2 20VJ s
ThinkPad L13 Gen 3 21B3
ThinkPad L13 Gen 3 21B4
ThinkPad L13 Yoga Gen 2 20VL s
ThinkPad L13 Yoga Gen 2 20VK s
ThinkPad L13 Yoga Gen 3 21B5
ThinkPad L13 Yoga Gen 3 21B6
ThinkPad L14 Gen 3 21C1 s
ThinkPad L14 Gen 3 21C2 s
ThinkPad L15 Gen 3 21C3 s
ThinkPad L15 Gen 3 21C4 s
ThinkPad P1 Gen 4 20Y3
ThinkPad P1 Gen 4 20Y4
ThinkPad P14s Gen 1 20S4
ThinkPad P14s Gen 1 20S5
ThinkPad P14s Gen 2 20VX
ThinkPad P14s Gen 2 20VY
ThinkPad P15s Gen 1 20T4 20T5
ThinkPad P15s Gen 2 20W6
ThinkPad P15s Gen 2 20W7
ThinkPad P15v Gen 3 21D8 21D9
ThinkPad P15v Gen 3 21EN 21EM
ThinkPad P43s 20RH
ThinkPad P43s 20RJ
ThinkPad P53s 20N6
ThinkPad P53s 20N7
ThinkPad T14 Gen 1 20S0
ThinkPad T14 Gen 1 20S1
ThinkPad T14 Gen 1 20S2
ThinkPad T14 Gen 1 20S3
ThinkPad T14 Gen 2 20W0
ThinkPad T14 Gen 2 20W1
ThinkPad T15 20S6
ThinkPad T15 20S7
ThinkPad T15 Gen 2 20W4
ThinkPad T15 Gen 2 20W5
ThinkPad T15p Gen 3 21DA 21DB
ThinkPad T490 20N2
ThinkPad T490 20N3
ThinkPad T490 20RY
ThinkPad T490 20RX
ThinkPad T490 Type 20Q9
20QH
ThinkPad T590 20N4
ThinkPad T590 20N5
ThinkPad S2 Gen 6 Type 20VM China Only
ThinkPad S2 Yoga Gen 6 Type 20VN China Only
ThinkPad X1 Extreme 4th Gen 20Y5
ThinkPad X1 Extreme 4th Gen 20Y6
ThinkPad X1 Fold Gen 1 20RK
ThinkPad X1 Fold Gen 1 20RL
X13 Yoga Gen 3 21AW (ThinkPad
X13 Yoga Gen 3 21AX (ThinkPad
ThinkPad Z13 Gen 1 21D2
ThinkPad Z13 Gen 1 21D3
ThinkPad Z16 Gen 1 21D4
ThinkPad Z16 Gen 1 21D5
ThinkPad E14 20RA
ThinkPad E14 20RB
ThinkPad E14 Gen 2 20TA
ThinkPad E14 Gen 2 20TB
ThinkPad E14 Gen 4 21E3 s
ThinkPad E14 Gen 4 21E4 s
ThinkPad E15 20RD
ThinkPad E15 20RE
ThinkPad E15 Gen 2 20TD
ThinkPad E15 Gen 2 20TE
ThinkPad E15 Gen 4 21E6 21E7 s
ThinkPad E490 20N8
ThinkPad E490 20N9
ThinkPad E490s 20NG
ThinkPad E590 20NB
ThinkPad E590 20NC
ThinkPad L14 20U1 s
ThinkPad L14 20U2 s
ThinkPad L14 Gen 2 Type 20X1 20X2 s
ThinkPad L15 20U3
ThinkPad L15 20U4
ThinkPad L15 Gen 2 Type 20X3 20X4
ThinkPad L490 20Q5 s
ThinkPad L490 20Q6 s
ThinkPad L590 20Q7 s
ThinkPad L590 20Q8 s
ThinkPad P1 Gen 2 20QT
ThinkPad P1 Gen 2 20QU
ThinkPad P1 Gen 3 20TH
ThinkPad P1 Gen 3 20TJ
ThinkPad P1 Gen 5 21DC 21DD
ThinkPad P14s Gen 3 21AK
ThinkPad P14s Gen 3 21AL
ThinkPad P15 Gen 1 20ST
ThinkPad P15 Gen 1 20SU
ThinkPad P15 Gen 2 20YQ s
ThinkPad P15 Gen 2 20YR s
ThinkPad P15v Gen 1 20TR
ThinkPad P15v Gen 2 21A9 s
ThinkPad P15v Gen 2 21AA s
ThinkPad P16 Gen 1 21D6
ThinkPad P16 Gen 1 21D7
ThinkPad P16s Gen 1 21BT
ThinkPad P16s Gen 1 21BU
ThinkPad P17 Gen 1 20SN
ThinkPad P17 Gen 1 20SQ
ThinkPad P17 Gen 2 20YU s
ThinkPad P17 Gen 2 20YV s
ThinkPad P53 20QN
ThinkPad P53 20QQ
Thinkpad P73 20QR
Thinkpad P73 20QS
ThinkPad T14 Gen 3 21AH
ThinkPad T14 Gen 3 21AJ
ThinkPad T14s 20T0
ThinkPad T14s 20T1
ThinkPad T14s Gen 2 20WM
ThinkPad T14s Gen 2 20WN
ThinkPad T14s Gen 3 21BR 21BS
ThinkPad T15g Gen 1 20UR 20US
ThinkPad T15g Gen 2 20YS
ThinkPad T15g Gen 2 20YT
ThinkPad T15p Gen 1 20TN 20TM
ThinkPad T15p Gen 2 21A7
ThinkPad T15p Gen 2 21A8
ThinkPad T16 Gen 1 21BV
ThinkPad T16 Gen 1 21BW
ThinkPad T490s 20NX
ThinkPad T490s 20NY
ThinkPad R14 Gen 2 Type 20TC PRC
ThinkPad R14 Gen 4 Types 21E5 PRC only
ThinkPad S3 2nd Gen type 20RG China only
ThinkPad X1 Carbon 10th Gen 21CB
ThinkPad X1 Carbon 10th Gen 21CC
ThinkPad X1 Carbon 7th Gen - 20QD
ThinkPad X1 Carbon 7th Gen - 20QE
ThinkPad X1 Carbon 7th Gen - 20R1
ThinkPad X1 Carbon 7th Gen - 20R2
ThinkPad X1 Carbon 8th Gen - 20U9
ThinkPad X1 Carbon 8th Gen - 20UA
ThinkPad X1 Carbon 9th Gen 20XW
ThinkPad X1 Carbon 9th Gen 20XX
ThinkPad X1 Extreme 2nd Gen 20QV
ThinkPad X1 Extreme 2nd Gen 20QW
ThinkPad X1 Extreme 3rd Gen 20TK
ThinkPad X1 Extreme 3rd Gen 20TL
ThinkPad X1 Extreme Gen 5 21DE
ThinkPad X1 Extreme Gen 5 21DF
ThinkPad X1 Nano Gen 1 20UN 20UQ
ThinkPad X1 Nano Gen 2 21E8 21E9
ThinkPad X1 Titanium 20QA
ThinkPad X1 Titanium 20QB
ThinkPad X1 Yoga 4th Gen 20QF
ThinkPad X1 Yoga 4th Gen 20QG
ThinkPad X1 Yoga 4th Gen 20SA
ThinkPad X1 Yoga 4th Gen 20SB
ThinkPad X1 Yoga 5th Gen 20UB
ThinkPad X1 Yoga 5th Gen 20UC
ThinkPad X1 Yoga 6th Gen 20XY
ThinkPad X1 Yoga 6th Gen 20Y0
ThinkPad X1 Yoga 7th Gen 21CD
ThinkPad X1 Yoga 7th Gen 21CE
ThinkPad X12 Detachable Gen 1 20UW
ThinkPad X12 Detachable Gen 1 20UV
ThinkPad X13 20T2
ThinkPad X13 20T3
ThinkPad X13 Gen 2 20WK
ThinkPad X13 Gen 2 20WL
ThinkPad X13 Gen 3 21BN 21BQ
ThinkPad X13 Yoga Gen 1
ThinkPad X13 Yoga Gen 2 20W8
ThinkPad X13 Yoga Gen 2 20W9
ThinkPad X390 20Q0
ThinkPad X390 20Q1
ThinkPad X390 20SC
ThinkPad X390 20SD
ThinkPad X390 Yoga

Software vendor:
Lenovo

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to insufficient validation of user-supplied input in the SMM driver. A local user can execute arbitrary code with elevated privileges.

Install updates from vendor's website.

• https://support.lenovo.com/us/en/product_security/LEN-106014