CVE-2020-8341
Low
Description
In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash. While this provides sufficient protection, an additional layer of protection is provided by SPI Protected Range Registers (PRx). After resuming from S3 sleep mode in various versions of BIOS for some Lenovo ThinkPad systems, the PRx is not set. This does not impact the SMM BIOS Write Protection, which keeps systems protected.
SeverityLow
CVSS2.4
Exploit probability—
ProductLenovo Thinkpad T490 \(20nx\) Firmware
PublishedSep 1, 2020
First seenSep 1, 2020
How to fix
Update
- lenovo thinkpad_t490_\(20nx\)_firmwaren2iet90w or later
- lenovo thinkpad_t490_\(20qx\)_firmwaren2iet90w or later
- lenovo thinkpad_t490_\(20rx\)_firmwaren2ret16w or later
- lenovo thinkpad_t490s_\(20nx\)_firmwaren2jet89w or later
- lenovo thinkpad_t495_drift_firmware2020-08-30 or later
- lenovo thinkpad_t590_\(20nx\)_firmwaren2iet90w or later
- lenovo thinkpad_x1_carbon_\(20qx\)_firmwaren2het54w or later
- lenovo thinkpad_x1_yoga_\(20qx\)_firmwaren2het54w or later
- lenovo thinkpad_x390_\(20qx\)_firmwaren2jet89w or later
- lenovo thinkpad_x390_\(20sx\)_firmwaren2set18w or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lenovo thinkpad_t490_\(20nx\)_firmware | v < n2iet90w | n2iet90w |
| lenovo thinkpad_t490_\(20qx\)_firmware | v < n2iet90w | n2iet90w |
| lenovo thinkpad_t490_\(20rx\)_firmware | v < n2ret16w | n2ret16w |
| lenovo thinkpad_t490s_\(20nx\)_firmware | v < n2jet89w | n2jet89w |
| lenovo thinkpad_t495_drift_firmware | v < 2020-08-30 | 2020-08-30 |
| lenovo thinkpad_t590_\(20nx\)_firmware | v < n2iet90w | n2iet90w |
| lenovo thinkpad_x1_carbon_\(20qx\)_firmware | v < n2het54w | n2het54w |
| lenovo thinkpad_x1_yoga_\(20qx\)_firmware | v < n2het54w | n2het54w |
| lenovo thinkpad_x390_\(20qx\)_firmware | v < n2jet89w | n2jet89w |
| lenovo thinkpad_x390_\(20sx\)_firmware | v < n2set18w | n2set18w |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.