Medium severity · published Apr 22, 2022
CVE-2022-1107
During an internal product security audit a potential vulnerability due to use of Boot Services in the SmmOEMInt15 SMI handler was discovered in some ThinkPad models could be…
6.7
CVSS
0.3%
EPSS
No
On KEV
Description
During an internal product security audit a potential vulnerability due to use of Boot Services in the SmmOEMInt15 SMI handler was discovered in some ThinkPad models could be exploited by an attacker with elevated privileges that could allow for execution of code.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
T1
Thinkpad 11e Firmware · Lenovo
before n15et78w · source: NVD
T1
Thinkpad 11e Yoga Firmware · Lenovo
before n15et78w · source: NVD
TH
Thinkpad Helix Firmware · Lenovo
before n17eta8w · source: NVD
TL
Thinkpad L560 Firmware · Lenovo
before n1het85w · source: NVD
TL
Thinkpad L570 Firmware · Lenovo
before n1xet65w · source: NVD
TP
Thinkpad P50s Firmware · Lenovo
before n1ket46w · source: NVD
TP
Thinkpad P51s Firmware · Lenovo
before n1vet50w · source: NVD
TP
Thinkpad P52s Firmware · Lenovo
before n27et36w · source: NVD
TS
Thinkpad S540 Firmware · Lenovo
before gpet80ww · source: NVD
TT
Thinkpad T550 Firmware · Lenovo
before n11et50w · source: NVD
TT
Thinkpad T560 Firmware · Lenovo
before n1ket46w · source: NVD
TT
Thinkpad T570 Firmware · Lenovo
before n1vet50w · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-1107
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-1107
Vendor Advisory
https://support.lenovo.com/us/en/product_security/LEN-84943
More from Thinkpad 11e Firmware
6.8
CVE-2020-8320
An internal shell was included in BIOS image in some ThinkPad models that could allow escalation of privilege
6.7
CVE-2020-8323
A potential vulnerability in the SMI callback function used in the Legacy SD driver in some Lenovo ThinkPad, ThinkStation, and Lenovo Notebook models may allow arbitrary code…
6.5
CVE-2019-10724
There is a vulnerability with the Dolby DAX2 API system services in which a low-privileged user can terminate arbitrary processes that are running at a higher privilege