Medium severity · published Feb 14, 2020
CVE-2019-6190
Lenovo was notified of a potential denial of service vulnerability, affecting various versions of BIOS for Lenovo Desktop, Desktop - All in One, and ThinkStation, that could cause…
5.5
CVSS
0.3%
EPSS
No
On KEV
Description
Lenovo was notified of a potential denial of service vulnerability, affecting various versions of BIOS for Lenovo Desktop, Desktop - All in One, and ThinkStation, that could cause PCRs to be cleared intermittently after resuming from sleep (S3) on systems with Intel TXT enabled.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HD
H50-30g Desktop Firmware · Lenovo
before fckt97a · source: NVD
L6
Lenovo 63 Desktop Firmware · Lenovo
before fckt97a · source: NVD
MD
M4500 Desktop Firmware · Lenovo
before fckt97a · source: NVD
MI
M4500 ID Desktop Firmware · Lenovo
before fckt97a · source: NVD
MI
M4550 ID Desktop Firmware · Lenovo
before fckt97a · source: NVD
Q4
Qitian 4500 Desktop Firmware · Lenovo
before fckt97a · source: NVD
QB
Qitian B4550 Desktop Firmware · Lenovo
before fckt97a · source: NVD
QM
Qitian M4550 Desktop Firmware · Lenovo
before fckt97a · source: NVD
TM
Thinkcenter M700z Firmware · Lenovo
before fvkt64a · source: NVD
TM
Thinkcenter M800z Firmware · Lenovo
before fvkt64a · source: NVD
TE
Thinkcentre E73 Desktop Firmware · Lenovo
before fckt97a · source: NVD
TE
Thinkcentre E73s Desktop Firmware · Lenovo
before fckt97a · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-6190
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-6190
Vendor Advisory
https://support.lenovo.com/us/en/product_security/LEN-28078
Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/176178
More from H50-30g Desktop Firmware
9.8
CVE-2019-6188
The BIOS tamper detection mechanism was not triggered in Lenovo ThinkPad T460p, BIOS versions up to R07ET90W, and T470p, BIOS versions up to R0FET50W, which may allow for…
6.4
CVE-2019-6172
A potential vulnerability in the SMI callback function used in Legacy USB driver using passed parameter without sufficient checking in some Lenovo ThinkPad models may allow…
6.4
CVE-2019-6170
A potential vulnerability in the SMI callback function used in the Legacy USB driver using boot services structure in runtime phase in some Lenovo ThinkPad models may allow…
3.3
CVE-2019-6156
In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash