Medium severity · published Apr 22, 2022
CVE-2021-4212
A potential vulnerability in the SMI callback function used in the Legacy BIOS mode driver in some Lenovo Notebook models may allow an attacker with local access and elevated…
6.7
CVSS
0.3%
EPSS
No
On KEV
Description
A potential vulnerability in the SMI callback function used in the Legacy BIOS mode driver in some Lenovo Notebook models may allow an attacker with local access and elevated privileges to execute arbitrary code.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CF
C340-14iml Firmware · Lenovo
All versions, or not specified · source: NVD
CF
C340-15iml Firmware · Lenovo
All versions, or not specified · source: NVD
DF
D330-10igm Firmware · Lenovo
All versions, or not specified · source: NVD
D3
Duet 3-10igl5 Firmware · Lenovo
All versions, or not specified · source: NVD
EF
E41-50 Firmware · Lenovo
All versions, or not specified · source: NVD
FF
Flex-14iml Firmware · Lenovo
All versions, or not specified · source: NVD
FF
Flex-15iml Firmware · Lenovo
All versions, or not specified · source: NVD
I3
Ideapad 3-14are05 Firmware · Lenovo
All versions, or not specified · source: NVD
I3
Ideapad 3-15are05 Firmware · Lenovo
All versions, or not specified · source: NVD
I3
Ideapad 3-17are05 Firmware · Lenovo
All versions, or not specified · source: NVD
I5
Ideapad 5 Pro-14acn6 Firmware · Lenovo
All versions, or not specified · source: NVD
I5
Ideapad 5 Pro-14itl6 Firmware · Lenovo
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-4212
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-4212
Patch
https://support.lenovo.com/us/en/product_security/LEN-77639
More from C340-14iml Firmware
6.7
CVE-2020-8321
A potential vulnerability in the SMI callback function used in the System Lock Preinstallation driver in some Lenovo Notebook and ThinkStation models may allow arbitrary code…