CVE-2020-8332
Medium
Description
A potential vulnerability in the SMI callback function used in the legacy BIOS mode USB drivers in some legacy Lenovo and IBM System x servers may allow arbitrary code execution. Servers operating in UEFI mode are not affected.
SeverityMedium
CVSS6.4
Exploit probability—
ProductLenovo System X3300 M4 Firmware
PublishedOct 14, 2020
First seenOct 14, 2020
Weakness typeCWE-367CWE-367
How to fix
Update
- lenovo system_x3300_m4_firmwareyae166b or later
- lenovo bladecenter_hs23_firmwaretke170b or later
- lenovo bladecenter_hs23e_firmwareahe172b or later
- lenovo compute_node-x440_firmwarecge128a or later
- lenovo flex_system_x220_firmwarekse170b or later
- lenovo flex_system_x240_firmwareb2e172b or later
- lenovo flex_system_x440_firmwarecne172b or later
- lenovo nextscale_nx360_m4_firmwarefhe132b or later
- lenovo system_x3500_m4_firmwarey5e170b or later
- lenovo system_x3530_m4_firmwarebee174b or later
- lenovo system_x3550_m4_firmwared7e174b or later
- lenovo system_x3630_m4_firmwarebee174b or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lenovo system_x3300_m4_firmware | v < yae166b | yae166b |
| lenovo bladecenter_hs23_firmware | v < tke170b | tke170b |
| lenovo bladecenter_hs23e_firmware | v < ahe172b | ahe172b |
| lenovo compute_node-x440_firmware | v < cge128a | cge128a |
| lenovo flex_system_x220_firmware | v < kse170b | kse170b |
| lenovo flex_system_x240_firmware | v < b2e172b | b2e172b |
| lenovo flex_system_x440_firmware | v < cne172b | cne172b |
| lenovo nextscale_nx360_m4_firmware | v < fhe132b | fhe132b |
| lenovo system_x3500_m4_firmware | v < y5e170b | y5e170b |
| lenovo system_x3530_m4_firmware | v < bee174b | bee174b |
| lenovo system_x3550_m4_firmware | v < d7e174b | d7e174b |
| lenovo system_x3630_m4_firmware | v < bee174b | bee174b |
| lenovo system_x3650_m4_firmware | v < vve172b | vve172b |
| lenovo system_x3650_m4_bd_firmware | v < vve172b | vve172b |
| lenovo system_x3650_m4_hd_firmware | v < vve172b | vve172b |
| lenovo system_x3750_m4_firmware | v < a5e130a, v < koe170b | a5e130a, koe170b |
| lenovo idataplex_dx360_m4_firmware | v < tde168b | tde168b |
| lenovo idataplex_dx360_m4_water_cooled_firmware | v < tde168b | tde168b |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.