CVE-2022-1107
Medium
Description
During an internal product security audit a potential vulnerability due to use of Boot Services in the SmmOEMInt15 SMI handler was discovered in some ThinkPad models could be exploited by an attacker with elevated privileges that could allow for execution of code.
SeverityMedium
CVSS6.7
Exploit probability—
ProductLenovo Thinkpad 11e Firmware
PublishedApr 22, 2022
First seenApr 22, 2022
Weakness typeCWE-20Improper input validation
How to fix
Update
- lenovo thinkpad_11e_firmwaren15et78w or later
- lenovo thinkpad_helix_firmwaren17eta8w or later
- lenovo thinkpad_l560_firmwaren1het85w or later
- lenovo thinkpad_l570_firmwaren1xet65w or later
- lenovo thinkpad_p50s_firmwaren1ket46w or later
- lenovo thinkpad_p51s_firmwaren1vet50w or later
- lenovo thinkpad_p52s_firmwaren27et36w or later
- lenovo thinkpad_s540_firmwaregpet80ww or later
- lenovo thinkpad_t550_firmwaren11et50w or later
- lenovo thinkpad_t560_firmwaren1ket46w or later
- lenovo thinkpad_t570_firmwaren1vet50w or later
- lenovo thinkpad_t580_firmwaren27et36w or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lenovo thinkpad_11e_firmware | v < n15et78w | n15et78w |
| lenovo thinkpad_helix_firmware | v < n17eta8w | n17eta8w |
| lenovo thinkpad_l560_firmware | v < n1het85w | n1het85w |
| lenovo thinkpad_l570_firmware | v < n1xet65w | n1xet65w |
| lenovo thinkpad_p50s_firmware | v < n1ket46w | n1ket46w |
| lenovo thinkpad_p51s_firmware | v < n1vet50w | n1vet50w |
| lenovo thinkpad_p52s_firmware | v < n27et36w | n27et36w |
| lenovo thinkpad_s540_firmware | v < gpet80ww | gpet80ww |
| lenovo thinkpad_t550_firmware | v < n11et50w | n11et50w |
| lenovo thinkpad_t560_firmware | v < n1ket46w | n1ket46w |
| lenovo thinkpad_t570_firmware | v < n1vet50w | n1vet50w |
| lenovo thinkpad_t580_firmware | v < n27et36w | n27et36w |
| lenovo thinkpad_x1_tablet_gen_1_firmware | v < n1let86w | n1let86w |
| lenovo thinkpad_x1_tablet_gen_2_firmware | v < n1oet50w | n1oet50w |
| lenovo thinkpad_w540_firmware | v < gnet92ww | gnet92ww |
| lenovo thinkpad_w541_firmware | v < gnet92ww | gnet92ww |
| lenovo thinkpad_w550s_firmware | v < n11et50w | n11et50w |
| lenovo thinkpad_x1_carbon_3rd_gen_firmware | v < n14et52w | n14et52w |
| lenovo thinkpad_x1_carbon_4th_gen_firmware | v < n1fet70w | n1fet70w |
| lenovo thinkpad_x1_carbon_5th_gen_kabylake_firmware | v < n1met55w | n1met55w |
| lenovo thinkpad_x1_carbon_5th_gen_skylake_firmware | v < n1met55w | n1met55w |
| lenovo thinkpad_x1_yoga_firmware | v < n1fet70w | n1fet70w |
| lenovo thinkpad_x1_yoga_gen_2_firmware | v < n1net47w | n1net47w |
| lenovo thinkpad_x1_yoga_gen_3_firmware | v < n25et50w | n25et50w |
| lenovo thinkpad_x250_firmware | v < n10et58w | n10et58w |
| lenovo thinkpad_x280_firmware | v < n20et44w | n20et44w |
| lenovo thinkpad_x390_firmware | v < n2let60w | n2let60w |
| lenovo thinkpad_11e_yoga_firmware | v < n15et78w | n15et78w |
| lenovo thinkpad_yoga_15_firmware | v < n19et61w | n19et61w |
| lenovo thinkpad_yoga_260_firmware | v < n1get98w | n1get98w |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.