CVE-2021-3719
Medium
Description
A potential vulnerability in the SMI callback function that saves and restore boot script tables used for resuming from sleep state in some ThinkCentre and ThinkStation models may allow an attacker with local access and elevated privileges to execute arbitrary code.
SeverityMedium
CVSS6.7
Exploit probability—
ProductLenovo Thinkcentre E93 Firmware
PublishedNov 12, 2021
First seenNov 12, 2021
Weakness typeCWE-20Improper input validation
How to fix
Update
- lenovo thinkcentre_e93_firmwarefbktdfa or later
- lenovo thinkcentre_m600_firmwarem00kt65a or later
- lenovo thinkcentre_m700_tiny_firmwarefwktb9a or later
- lenovo thinkcentre_m73_firmwarefhkt86a or later
- lenovo thinkcentre_m73p_firmwarefbktdfa or later
- lenovo thinkcentre_m800_firmwarefwktb9a or later
- lenovo thinkcentre_m818z_firmwarem1ekt23a or later
- lenovo thinkcentre_m83_firmwarefbktdfa or later
- lenovo thinkcentre_m900_firmwarefwktb9a or later
- lenovo thinkcentre_m900x_firmwarefwktb9a or later
- lenovo thinkcentre_m93_firmwarefbktdfa or later
- lenovo thinkcentre_m93p_firmwarefbktdfa or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lenovo thinkcentre_e93_firmware | v < fbktdfa | fbktdfa |
| lenovo thinkcentre_m600_firmware | v < m00kt65a | m00kt65a |
| lenovo thinkcentre_m700_tiny_firmware | v < fwktb9a | fwktb9a |
| lenovo thinkcentre_m73_firmware | v < fhkt86a | fhkt86a |
| lenovo thinkcentre_m73p_firmware | v < fbktdfa | fbktdfa |
| lenovo thinkcentre_m800_firmware | v < fwktb9a | fwktb9a |
| lenovo thinkcentre_m818z_firmware | v < m1ekt23a | m1ekt23a |
| lenovo thinkcentre_m83_firmware | v < fbktdfa | fbktdfa |
| lenovo thinkcentre_m900_firmware | v < fwktb9a | fwktb9a |
| lenovo thinkcentre_m900x_firmware | v < fwktb9a | fwktb9a |
| lenovo thinkcentre_m93_firmware | v < fbktdfa | fbktdfa |
| lenovo thinkcentre_m93p_firmware | v < fbktdfa | fbktdfa |
| lenovo thinkcentre_m4500q_firmware | v < fhkt86a | fhkt86a |
| lenovo thinkcentre_m6500t\/s_firmware | v < fbktdfa | fbktdfa |
| lenovo thinkcentre_m8500t\/s_firmware | v < fbktdfa | fbktdfa |
| lenovo thinkcentre_x1_firmware | v < m0hkt50a | m0hkt50a |
| lenovo thinkstation_p300_firmware | v < fbktdfa | fbktdfa |
| lenovo thinkstation_p500_firmware | v < a4ktaba | a4ktaba |
| lenovo thinkstation_p700_firmware | v < a5ktaba | a5ktaba |
| lenovo thinkstation_p900_firmware | v < a6ktaba | a6ktaba |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.