CVE-2021-3843
Medium
Description
A potential vulnerability in the SMI function to access EEPROM in some ThinkPad models may allow an attacker with local access and elevated privileges to execute arbitrary code.
SeverityMedium
CVSS6.7
Exploit probability—
ProductLenovo Thinkpad 11e 3rd Gen Firmware
PublishedNov 12, 2021
First seenNov 12, 2021
Weakness typeCWE-20Improper input validation
How to fix
Update
- lenovo thinkpad_l14_gen_1_firmware1.15 or later
- lenovo thinkpad_l14_firmware1.20.1.17 or later
- lenovo thinkpad_l15_gen_1_firmware1.15 or later
- lenovo thinkpad_l15_firmware1.20.1.17 or later
- lenovo thinkpad_x12_detachable_gen_1_firmware1.16 or later
- lenovo thinkpad_x390_yoga_firmwaren2let87w or later
- lenovo thinkpad_x1_fold_gen_1_firmwaren2pet50w or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lenovo thinkpad_11e_3rd_gen_firmware | v ≤ 1.22, v ≤ 1.29 | — |
| lenovo thinkpad_11e_4th_gen_i3_firmware | v ≤ 1.22 | — |
| lenovo thinkpad_11e_4th_gen_i7_firmware | v ≤ 1.22 | — |
| lenovo thinkpad_11e_4th_gen_i5_firmware | v ≤ 1.22 | — |
| lenovo thinkpad_11e_4th_gen_celeron_firmware | v ≤ 1.27 | — |
| lenovo thinkpad_11e_yoga_gen_6_firmware | v ≤ 1.12 | — |
| lenovo thinkpad_13_gen_2_firmware | v ≤ 1.29 | — |
| lenovo thinkpad_l13_firmware | v ≤ 1.31 | — |
| lenovo thinkpad_l13_gen_2_firmware | v ≤ 1.11, v ≤ 1.08 | — |
| lenovo thinkpad_l13_yoga_firmware | v ≤ 1.31 | — |
| lenovo thinkpad_l13_yoga_gen_2_firmware | v ≤ 1.11, v ≤ 1.08 | — |
| lenovo thinkpad_l14_gen_1_firmware | v < 1.15 | 1.15 |
| lenovo thinkpad_l14_firmware | v < 1.20.1.17 | 1.20.1.17 |
| lenovo thinkpad_l15_gen_1_firmware | v < 1.15 | 1.15 |
| lenovo thinkpad_l15_firmware | v < 1.20.1.17 | 1.20.1.17 |
| lenovo thinkpad_l380_firmware | v ≤ 1.26 | — |
| lenovo thinkpad_l380_yoga_firmware | v ≤ 1.26 | — |
| lenovo thinkpad_l390_yoga_firmware | v ≤ 1.35 | — |
| lenovo thinkpad_l390_firmware | v ≤ 1.35 | — |
| lenovo thinkpad_s5_2nd_gen_firmware | v ≤ 1.28 | — |
| lenovo thinkpad_t460_firmware | v ≤ 1.43.1.11 | — |
| lenovo thinkpad_s2_gen_6_firmware | v ≤ 2021-09-30 | — |
| lenovo thinkpad_s2_yoga_gen_6_firmware | v ≤ 2021-09-30 | — |
| lenovo thinkpad_x12_detachable_gen_1_firmware | v < 1.16 | 1.16 |
| lenovo thinkpad_x260_firmware | v ≤ 1.47\/1.15 | — |
| lenovo thinkpad_x380_yoga_firmware | v ≤ 1.34 | — |
| lenovo thinkpad_x390_yoga_firmware | v < n2let87w | n2let87w |
| lenovo thinkpad_11e_5th_gen_firmware | v ≤ 1.13 | — |
| lenovo thinkpad_x1_fold_gen_1_firmware | v < n2pet50w | n2pet50w |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.