CVE-2022-4574
Medium
Description
An SMI handler input validation vulnerability in the BIOS of some ThinkPad models could allow an attacker with local access and elevated privileges to execute arbitrary code.
SeverityMedium
CVSS6.7
Exploit probability—
ProductLenovo Thinkpad X13 Yoga Gen 2 Firmware
PublishedOct 30, 2023
First seenOct 30, 2023
Weakness typeCWE-20Improper input validation
How to fix
Update
- lenovo thinkpad_x13_yoga_gen_2_firmware1.40 or later
- lenovo thinkpad_x13_yoga_gen_1_firmware1.45 or later
- lenovo thinkpad_x13_gen_3_firmware1.33 or later
- lenovo thinkpad_x13_gen_2_firmware1.51 or later
- lenovo thinkpad_x13_firmware1.26 or later
- lenovo thinkpad_x1_yoga_7th_gen_firmware1.37 or later
- lenovo thinkpad_x1_yoga_6th_gen_firmware1.59 or later
- lenovo thinkpad_x1_yoga_5th_gen_firmware1.30 or later
- lenovo thinkpad_x1_yoga_4th_gen_firmware1.56 or later
- lenovo thinkpad_x1_titanium_firmware1.24 or later
- lenovo thinkpad_x1_nano_gen_2_firmware1.18 or later
- lenovo thinkpad_x1_nano_gen_1_firmware1.55 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lenovo thinkpad_x13_yoga_gen_2_firmware | v < 1.40 | 1.40 |
| lenovo thinkpad_x13_yoga_gen_1_firmware | v < 1.45 | 1.45 |
| lenovo thinkpad_x13_gen_3_firmware | v < 1.33 | 1.33 |
| lenovo thinkpad_x13_gen_2_firmware | v < 1.51 | 1.51 |
| lenovo thinkpad_x13_firmware | v < 1.26 | 1.26 |
| lenovo thinkpad_x1_yoga_7th_gen_firmware | v < 1.37 | 1.37 |
| lenovo thinkpad_x1_yoga_6th_gen_firmware | v < 1.59 | 1.59 |
| lenovo thinkpad_x1_yoga_5th_gen_firmware | v < 1.30 | 1.30 |
| lenovo thinkpad_x1_yoga_4th_gen_firmware | v < 1.56 | 1.56 |
| lenovo thinkpad_x1_titanium_firmware | v < 1.24 | 1.24 |
| lenovo thinkpad_x1_nano_gen_2_firmware | v < 1.18 | 1.18 |
| lenovo thinkpad_x1_nano_gen_1_firmware | v < 1.55 | 1.55 |
| lenovo thinkpad_x1_fold_gen_1_firmware | No range specified | — |
| lenovo thinkpad_x1_extreme_gen_5_firmware | v < 1.16 | 1.16 |
| lenovo thinkpad_x1_extreme_4th_gen_firmware | v < 1.22 | 1.22 |
| lenovo thinkpad_x1_extreme_3rd_gen_firmware | v < 1.27 | 1.27 |
| lenovo thinkpad_x1_carbon_9th_gen_firmware | v < 1.59 | 1.59 |
| lenovo thinkpad_x1_carbon_8th_gen_firmware | v < 1.30 | 1.30 |
| lenovo thinkpad_x1_carbon_7th_gen_firmware | v < 1.56 | 1.56 |
| lenovo thinkpad_x1_carbon_10th_gen_firmware | v < 1.37 | 1.37 |
| lenovo thinkpad_t16_gen_1_firmware | v < 1.31 | 1.31 |
| lenovo thinkpad_t15p_gen_3_firmware | v < 1.15 | 1.15 |
| lenovo thinkpad_t15p_gen_2_firmware | v < 1.19 | 1.19 |
| lenovo thinkpad_t15p_gen_1_firmware | v < 1.32 | 1.32 |
| lenovo thinkpad_t15g_gen_2_firmware | v < 1.25 | 1.25 |
| lenovo thinkpad_t15g_gen_1_firmware | v < 1.32 | 1.32 |
| lenovo thinkpad_t15_gen_2_firmware | No range specified | — |
| lenovo thinkpad_t14s_gen_3_firmware | v < 1.33 | 1.33 |
| lenovo thinkpad_t14s_gen_2_firmware | v < 1.51 | 1.51 |
| lenovo thinkpad_t14s_firmware | v < 1.26 | 1.26 |
| lenovo thinkpad_t14_gen_3_firmware | v < 1.31 | 1.31 |
| lenovo thinkpad_t14_gen_2_firmware | No range specified | — |
| lenovo thinkpad_t14_gen_1_firmware | v < 1.28 | 1.28 |
| lenovo thinkpad_p17_gen_2_firmware | v < 1.25 | 1.25 |
| lenovo thinkpad_p17_gen_1_firmware | v < 1.32 | 1.32 |
| lenovo thinkpad_p16s_gen_1_firmware | v < 1.31 | 1.31 |
| lenovo thinkpad_p16_gen_1_firmware | v < 1.17 | 1.17 |
| lenovo thinkpad_p15v_gen_3_firmware | v < 1.15 | 1.15 |
| lenovo thinkpad_p15v_gen_2_firmware | v < 1.19 | 1.19 |
| lenovo thinkpad_p15v_gen_1_firmware | v < 1.32 | 1.32 |
| lenovo thinkpad_p15s_gen_2_firmware | No range specified | — |
| lenovo thinkpad_p15s_gen_1_firmware | v < 1.28 | 1.28 |
| lenovo thinkpad_p15_gen_2_firmware | v < 1.25 | 1.25 |
| lenovo thinkpad_p15_gen_1_firmware | v < 1.32 | 1.32 |
| lenovo thinkpad_p14s_gen_3_firmware | v < 1.31 | 1.31 |
| lenovo thinkpad_p14s_gen_2_firmware | No range specified | — |
| lenovo thinkpad_p14s_gen_1_firmware | v < 1.28 | 1.28 |
| lenovo thinkpad_p1_gen_5_firmware | v < 1.16 | 1.16 |
| lenovo thinkpad_p1_gen_4_firmware | 1.22 | — |
| lenovo thinkpad_p1_gen_3_firmware | v < 1.27 | 1.27 |
| lenovo thinkpad_l15_gen_2_firmware | No range specified | — |
| lenovo thinkpad_l15_firmware | v < 1.20 | 1.20 |
| lenovo thinkpad_l14_gen_2_firmware | No range specified | — |
| lenovo thinkpad_l14_firmware | v < 1.20 | 1.20 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.