Vulnerability-Lookup

BDU:2022-02965 (CVE-2021-4212)

Vulnerability from fstec – Published: 2022-05-17 – Updated: 2022-05-17 – View on bdu.fstec.ru Fixed

Title

Уязвимость функции обратного вызова обработчика System Management Interrupt (SMI) драйвера режима Legacy BIOS ноутбуков Lenovo, позволяющая нарушителю выполнить произвольный код с повышенными привилегиями

Summary

Уязвимость функции обратного вызова обработчика System Management Interrupt (SMI) драйвера режима Legacy BIOS ноутбуков Lenovo связана с недостаточной проверкой вводимых данных. Эксплуатация уязвимости может позволить нарушителю выполнить произвольный код с повышенными привилегиями

Severity

6.8 (Medium) CVSS 2.0


                      
                        AV:L/AC:L/Au:S/C:C/I:C/A:C

6.7 (Medium) CVSS 3.0


                      
                        CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Resource manipulation

Incidents

Being clarified

Remediation

Software update

CWE

CWE-20 - Недостаточная проверка вводимых данных

Aliases

CVE-2021-4212, LEN-77639

References

2 references

URL
https://support.lenovo.com/us/en/product_security/LEN-77639
https://vuldb.com/?id.198432

Impacted products

145 products from 1 vendor

Vendors

Lenovo Group Limited

Products

IdeaPad 3-14ARE05, IdeaPad 3-15ARE05, IdeaPad 3-17ARE05, Ideapad Gaming L340-15IRH, IdeaPad L340-15IWL, Legion Y540-15IRH, Legion Y540-15IRH-PG0, Legion Y540-17IRH, Legion Y540-17IRH-PG0, Legion Y545, Legion Y545-PG0, Legion Y7000-2019, Legion Y7000-2019-PG0, Ideapad S540-13IML, Ideapad Slim 7 Pro-14IHU5, Ideapad Slim 9-14ITL05, V140-15IWL, Yoga 7-14ACN6, Yoga C740-14IML, Yoga C740-15IML, Yoga C940-14IIL, Yoga Slim 7 Pro-14ACH5, Yoga Slim 7 Pro-14ACH5 O, Yoga Slim 7 Pro-14IHU5, Yoga Slim 7 Pro-14IHU5 O, Yoga Slim 7 Pro-14ITL5, Yoga Slim 9-14ITL05, ideapad 3-14IML05, ideapad 3-14ITL05, ideapad 3-14ITL6, ideapad 3-15IML05, ideapad 3-15ITL05, ideapad 3-15ITL6, ideapad 3-17IML05, ideapad 5-15IIL05, ideapad Creator 5-15IMH05, ideapad Gaming 3-15ARH05, ideapad Gaming 3-15IMH05, IdeaPad 3-17ITL6, Lenovo S14 G2 ITL, Lenovo 14W Gen 2, Lenovo 500w Gen 3, ideapad C340-14API, ideapad C340-14IML, ideapad C340-15IML, ideapad D330-10IGM, ideapad Duet 3-10IGL5, Lenovo E41-50, Lenovo E41-55, ideapad FLEX-14IML, ideapad FLEX-15IML, ideapad Flex 3-11ADA05, IdeaPad 3-15IGL05, IdeaPad 3-17IIL05, IdeaPad 5-14ITL05, IdeaPad Gaming 3-15IHU6, Ideapad 5-15ITL05, ideapad L3-15IML05, IdeaPad L3 15ITL6, Legion 5 Pro-16ACH6, Legion 5 Pro-16ACH6H, Legion 5 Pro-16ITH6, Legion 5 Pro-16ITH6H, Legion 5-15ACH6, Legion 5-15ACH6A, Legion 5-15ACH6H, Legion 5-15IMH6, Legion 5-15ITH6, Legion 5-15ITH6H, Legion 5-17ACH6, Legion 5-17ACH6H, Legion 5-17ITH6, Legion 5-17ITH6H, Legion 7-16ACHg6, Legion 7-16ITHg6, Ideapad S145-14IGM, Ideapad S145-14IIL, Ideapad S145-15IGM, Ideapad S145-15IIL, ideapad S340-13IML, ideapad S340-14API, ideapad S340-14IML, ideapad S340-15API, ideapad S340-15API Touch, ideapad S340-15IML, ideapad S340-15IML Touch, ideapad S530-13IML, ideapad S530-13IWL, ideapad S540-14API, ideapad S540-14IML, ideapad S540-14IML Touch, ideapad S540-15IML, ideapad S740-15IRH, ideapad S740-15IRH Touch, ideapad Slim 7-14ARE05, ideapad Slim 7-14IIL05, ideapad Slim 7-14ITL05, ideapad Slim 7-15IIL05, ideapad Slim 7-15IMH05, ideapad Slim 7-15ITL05, ThinkBook 13x ITG, ThinkBook 14 G3 ACL, ThinkBook 14 G3 ITL, ThinkBook 14s Yoga ITL, ThinkBook 15 G3 ACL, ThinkBook Plus G2 ITG, Lenovo V14 G1-IML, Lenovo V14 G2-ITL, Lenovo V14-ARE, Lenovo V14-IGL, Lenovo V14-IIL, Lenovo V15 G1-IML, Lenovo V15 G2-ITL, Lenovo V15-IGL, Lenovo V15-IIL, Lenovo V17 G2-ITL, Lenovo V17-IIL, Lenovo V340-17IWL, Yoga 6-13ALC6, Yoga 730-15IWL, Yoga Creator 7-15IMH05, Yoga Duet 7-13ITL6, Yoga Duet 7-13ITL6-LTE, Yoga S740-15IRH, Yoga Slim 7 Carbon 13ITL5, Yoga Slim 7-13ITL05, Yoga Slim 7-14ARE05, Yoga Slim 7-14IIL05, Yoga Slim 7-14ITL05, Yoga Slim 7-15IIL05, Yoga Slim 7-15IMH05, Yoga Slim 7-15ITL05, ideapad 3-14IGL05, ideapad 3-14IIL05, ideapad 3-15IIL05, ideapad 5 Pro-14ACN6, ideapad 5 Pro-14ITL6, ideapad 5 Pro-16ACH6, ideapad 5 Pro-16IHU6, ideapad 5-14ALC05, ideapad 5-14ARE05, ideapad Creator 5-16ACH6, ideapad Gaming 3-15ACH6, ThinkPad X1 Carbon 9th Gen, ThinkPad X1 Yoga 6th Gen

Versions

до dzcn42ww (IdeaPad 3-14ARE05), до DZCN42WW (IdeaPad 3-15ARE05), до DZCN42WW (IdeaPad 3-17ARE05), до BGCN35WW (Ideapad Gaming L340-15IRH), до ATCN46WW (IdeaPad L340-15IWL), до BHCN44WW (Legion Y540-15IRH), до BHCN44WW (Legion Y540-15IRH-PG0), до BHCN44WW (Legion Y540-17IRH), до BHCN44WW (Legion Y540-17IRH-PG0), до BHCN44WW (Legion Y545), до BHCN44WW (Legion Y545-PG0), до BHCN44WW (Legion Y7000-2019), до BHCN44WW (Legion Y7000-2019-PG0), - (Ideapad S540-13IML), - (Ideapad Slim 7 Pro-14IHU5), - (Ideapad Slim 9-14ITL05), до ATCN46WW (V140-15IWL), - (Yoga 7-14ACN6), - (Yoga C740-14IML), - (Yoga C740-15IML), - (Yoga C940-14IIL), - (Yoga Slim 7 Pro-14ACH5), - (Yoga Slim 7 Pro-14ACH5 O), - (Yoga Slim 7 Pro-14IHU5), - (Yoga Slim 7 Pro-14IHU5 O), - (Yoga Slim 7 Pro-14ITL5), - (Yoga Slim 9-14ITL05), - (ideapad 3-14IML05), - (ideapad 3-14ITL05), - (ideapad 3-14ITL6), - (ideapad 3-15IML05), - (ideapad 3-15ITL05), - (ideapad 3-15ITL6), - (ideapad 3-17IML05), - (ideapad 5-15IIL05), до EGCN36WW (ideapad Creator 5-15IMH05), до FCCN17WW (ideapad Gaming 3-15ARH05), до EGCN36WW (ideapad Gaming 3-15IMH05), - (IdeaPad 3-17ITL6), - (Lenovo S14 G2 ITL), - (Lenovo 14W Gen 2), - (Lenovo 500w Gen 3), - (ideapad C340-14API), до CKCN18WW (ideapad C340-14IML), до CRCN19WW (ideapad C340-15IML), до 8NCN42WW (ideapad D330-10IGM), до EQCN31WW (ideapad Duet 3-10IGL5), до G2CN23WW (Lenovo E41-50), - (Lenovo E41-55), до CKCN18WW (ideapad FLEX-14IML), до CRCN19WW (ideapad FLEX-15IML), - (ideapad Flex 3-11ADA05), - (IdeaPad 3-15IGL05), - (IdeaPad 3-17IIL05), - (IdeaPad 5-14ITL05), - (IdeaPad Gaming 3-15IHU6), до FHCN64WW (Ideapad 5-15ITL05), - (ideapad L3-15IML05), - (IdeaPad L3 15ITL6), - (Legion 5 Pro-16ACH6), - (Legion 5 Pro-16ACH6H), - (Legion 5 Pro-16ITH6), - (Legion 5 Pro-16ITH6H), - (Legion 5-15ACH6), - (Legion 5-15ACH6A), - (Legion 5-15ACH6H), - (Legion 5-15IMH6), - (Legion 5-15ITH6), - (Legion 5-15ITH6H), - (Legion 5-17ACH6), - (Legion 5-17ACH6H), - (Legion 5-17ITH6), - (Legion 5-17ITH6H), - (Legion 7-16ACHg6), - (Legion 7-16ITHg6), - (Ideapad S145-14IGM), - (Ideapad S145-14IIL), - (Ideapad S145-15IGM), - (Ideapad S145-15IIL), до BZCN23WW (ideapad S340-13IML), до AMCN30WW (ideapad S340-14API), до CRCN19WW (ideapad S340-14IML), до AMCN30WW (ideapad S340-15API), до AMCN30WW (ideapad S340-15API Touch), до CRCN19WW (ideapad S340-15IML), до CRCN19WW (ideapad S340-15IML Touch), - (ideapad S530-13IML), - (ideapad S530-13IWL), - (ideapad S540-14API), до CKCN18WW (ideapad S540-14IML), до CKCN18WW (ideapad S540-14IML Touch), до CNCN20WW (ideapad S540-15IML), - (ideapad S740-15IRH), - (ideapad S740-15IRH Touch), до DMCN41WW (ideapad Slim 7-14ARE05), до DHCN33WW (ideapad Slim 7-14IIL05), до FBCN27WW (ideapad Slim 7-14ITL05), до DHCN33WW (ideapad Slim 7-15IIL05), до DNCN30WW (ideapad Slim 7-15IMH05), до FBCN27WW (ideapad Slim 7-15ITL05), до HLCN27WW (ThinkBook 13x ITG), - (ThinkBook 14 G3 ACL), до HRCN10WW (ThinkBook 14 G3 ITL), - (ThinkBook 14s Yoga ITL), - (ThinkBook 15 G3 ACL), до GYCN28WW (ThinkBook Plus G2 ITG), - (Lenovo V14 G1-IML), - (Lenovo V14 G2-ITL), до DZCN42WW (Lenovo V14-ARE), - (Lenovo V14-IGL), - (Lenovo V14-IIL), - (Lenovo V15 G1-IML), - (Lenovo V15 G2-ITL), - (Lenovo V15-IGL), - (Lenovo V15-IIL), - (Lenovo V17 G2-ITL), - (Lenovo V17-IIL), до ATCN46WW (Lenovo V340-17IWL), до H6CN14WW (Yoga 6-13ALC6), - (Yoga 730-15IWL), до DNCN30WW (Yoga Creator 7-15IMH05), - (Yoga Duet 7-13ITL6), - (Yoga Duet 7-13ITL6-LTE), - (Yoga S740-15IRH), до F7CN37WW (Yoga Slim 7 Carbon 13ITL5), до F7CN37WW (Yoga Slim 7-13ITL05), до DMCN41WW (Yoga Slim 7-14ARE05), до DHCN33WW (Yoga Slim 7-14IIL05), до FBCN27WW (Yoga Slim 7-14ITL05), до DHCN33WW (Yoga Slim 7-15IIL05), до DNCN30WW (Yoga Slim 7-15IMH05), до FBCN27WW (Yoga Slim 7-15ITL05), - (ideapad 3-14IGL05), - (ideapad 3-14IIL05), - (ideapad 3-15IIL05), до GECN30WW (ideapad 5 Pro-14ACN6), до GDCN61WW (ideapad 5 Pro-14ITL6), - (ideapad 5 Pro-16ACH6), до GRCN20WW (ideapad 5 Pro-16IHU6), до G5CN61WW (ideapad 5-14ALC05), до DTCN26WW (ideapad 5-14ARE05), - (ideapad Creator 5-16ACH6), до H3CN32WW (ideapad Gaming 3-15ACH6), - (ThinkPad X1 Carbon 9th Gen), - (ThinkPad X1 Yoga 6th Gen)

Product types

Firmware

Mitigations

Использование рекомендаций производителя: https://support.lenovo.com/us/en/product_security/LEN-77639

JSON

To clipboard

{
  "CVSS 2.0": "AV:L/AC:L/Au:S/C:C/I:C/A:C",
  "CVSS 3.0": "AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Lenovo Group Limited",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u0434\u043e dzcn42ww (IdeaPad 3-14ARE05), \u0434\u043e DZCN42WW (IdeaPad 3-15ARE05), \u0434\u043e DZCN42WW (IdeaPad 3-17ARE05), \u0434\u043e BGCN35WW (Ideapad Gaming L340-15IRH), \u0434\u043e ATCN46WW (IdeaPad L340-15IWL), \u0434\u043e BHCN44WW (Legion Y540-15IRH), \u0434\u043e BHCN44WW (Legion Y540-15IRH-PG0), \u0434\u043e BHCN44WW (Legion Y540-17IRH), \u0434\u043e BHCN44WW (Legion Y540-17IRH-PG0), \u0434\u043e BHCN44WW (Legion Y545), \u0434\u043e BHCN44WW (Legion Y545-PG0), \u0434\u043e BHCN44WW (Legion Y7000-2019), \u0434\u043e BHCN44WW (Legion Y7000-2019-PG0), - (Ideapad S540-13IML), - (Ideapad Slim 7 Pro-14IHU5), - (Ideapad Slim 9-14ITL05), \u0434\u043e ATCN46WW (V140-15IWL), - (Yoga 7-14ACN6), - (Yoga C740-14IML), - (Yoga C740-15IML), - (Yoga C940-14IIL), - (Yoga Slim 7 Pro-14ACH5), - (Yoga Slim 7 Pro-14ACH5 O), - (Yoga Slim 7 Pro-14IHU5), - (Yoga Slim 7 Pro-14IHU5 O), - (Yoga Slim 7 Pro-14ITL5), - (Yoga Slim 9-14ITL05), - (ideapad 3-14IML05), - (ideapad 3-14ITL05), - (ideapad 3-14ITL6), - (ideapad 3-15IML05), - (ideapad 3-15ITL05), - (ideapad 3-15ITL6), - (ideapad 3-17IML05), - (ideapad 5-15IIL05), \u0434\u043e EGCN36WW (ideapad Creator 5-15IMH05), \u0434\u043e FCCN17WW (ideapad Gaming 3-15ARH05), \u0434\u043e EGCN36WW (ideapad Gaming 3-15IMH05), - (IdeaPad 3-17ITL6), - (Lenovo S14 G2 ITL), - (Lenovo 14W Gen 2), - (Lenovo 500w Gen 3), - (ideapad C340-14API), \u0434\u043e CKCN18WW (ideapad C340-14IML), \u0434\u043e CRCN19WW (ideapad C340-15IML), \u0434\u043e 8NCN42WW (ideapad D330-10IGM), \u0434\u043e EQCN31WW (ideapad Duet 3-10IGL5), \u0434\u043e G2CN23WW (Lenovo E41-50), - (Lenovo E41-55), \u0434\u043e CKCN18WW (ideapad FLEX-14IML), \u0434\u043e CRCN19WW (ideapad FLEX-15IML), - (ideapad Flex 3-11ADA05), - (IdeaPad 3-15IGL05), - (IdeaPad 3-17IIL05), - (IdeaPad 5-14ITL05), - (IdeaPad Gaming 3-15IHU6), \u0434\u043e FHCN64WW (Ideapad 5-15ITL05), - (ideapad L3-15IML05), - (IdeaPad L3 15ITL6), - (Legion 5 Pro-16ACH6), - (Legion 5 Pro-16ACH6H), - (Legion 5 Pro-16ITH6), - (Legion 5 Pro-16ITH6H), - (Legion 5-15ACH6), - (Legion 5-15ACH6A), - (Legion 5-15ACH6H), - (Legion 5-15IMH6), - (Legion 5-15ITH6), - (Legion 5-15ITH6H), - (Legion 5-17ACH6), - (Legion 5-17ACH6H), - (Legion 5-17ITH6), - (Legion 5-17ITH6H), - (Legion 7-16ACHg6), - (Legion 7-16ITHg6), - (Ideapad S145-14IGM), - (Ideapad S145-14IIL), - (Ideapad S145-15IGM), - (Ideapad S145-15IIL), \u0434\u043e BZCN23WW (ideapad S340-13IML), \u0434\u043e AMCN30WW (ideapad S340-14API), \u0434\u043e CRCN19WW (ideapad S340-14IML), \u0434\u043e AMCN30WW (ideapad S340-15API), \u0434\u043e AMCN30WW (ideapad S340-15API Touch), \u0434\u043e CRCN19WW (ideapad S340-15IML), \u0434\u043e CRCN19WW (ideapad S340-15IML Touch), - (ideapad S530-13IML), - (ideapad S530-13IWL), - (ideapad S540-14API), \u0434\u043e CKCN18WW (ideapad S540-14IML), \u0434\u043e CKCN18WW (ideapad S540-14IML Touch), \u0434\u043e CNCN20WW (ideapad S540-15IML), - (ideapad S740-15IRH), - (ideapad S740-15IRH Touch), \u0434\u043e DMCN41WW (ideapad Slim 7-14ARE05), \u0434\u043e DHCN33WW (ideapad Slim 7-14IIL05), \u0434\u043e FBCN27WW (ideapad Slim 7-14ITL05), \u0434\u043e DHCN33WW (ideapad Slim 7-15IIL05), \u0434\u043e DNCN30WW (ideapad Slim 7-15IMH05), \u0434\u043e FBCN27WW (ideapad Slim 7-15ITL05), \u0434\u043e HLCN27WW (ThinkBook 13x ITG), - (ThinkBook 14 G3 ACL), \u0434\u043e HRCN10WW (ThinkBook 14 G3 ITL), - (ThinkBook 14s Yoga ITL), - (ThinkBook 15 G3 ACL), \u0434\u043e GYCN28WW (ThinkBook Plus G2 ITG), - (Lenovo V14 G1-IML), - (Lenovo V14 G2-ITL), \u0434\u043e DZCN42WW (Lenovo V14-ARE), - (Lenovo V14-IGL), - (Lenovo V14-IIL), - (Lenovo V15 G1-IML), - (Lenovo V15 G2-ITL), - (Lenovo V15-IGL), - (Lenovo V15-IIL), - (Lenovo V17 G2-ITL), - (Lenovo V17-IIL), \u0434\u043e ATCN46WW (Lenovo V340-17IWL), \u0434\u043e H6CN14WW (Yoga 6-13ALC6), - (Yoga 730-15IWL), \u0434\u043e DNCN30WW (Yoga Creator 7-15IMH05), - (Yoga Duet 7-13ITL6), - (Yoga Duet 7-13ITL6-LTE), - (Yoga S740-15IRH), \u0434\u043e F7CN37WW (Yoga Slim 7 Carbon 13ITL5), \u0434\u043e F7CN37WW (Yoga Slim 7-13ITL05), \u0434\u043e DMCN41WW (Yoga Slim 7-14ARE05), \u0434\u043e DHCN33WW (Yoga Slim 7-14IIL05), \u0434\u043e FBCN27WW (Yoga Slim 7-14ITL05), \u0434\u043e DHCN33WW (Yoga Slim 7-15IIL05), \u0434\u043e DNCN30WW (Yoga Slim 7-15IMH05), \u0434\u043e FBCN27WW (Yoga Slim 7-15ITL05), - (ideapad 3-14IGL05), - (ideapad 3-14IIL05), - (ideapad 3-15IIL05), \u0434\u043e GECN30WW (ideapad 5 Pro-14ACN6), \u0434\u043e GDCN61WW (ideapad 5 Pro-14ITL6), - (ideapad 5 Pro-16ACH6), \u0434\u043e GRCN20WW (ideapad 5 Pro-16IHU6), \u0434\u043e G5CN61WW (ideapad 5-14ALC05), \u0434\u043e DTCN26WW (ideapad 5-14ARE05), - (ideapad Creator 5-16ACH6), \u0434\u043e H3CN32WW (ideapad Gaming 3-15ACH6), - (ThinkPad X1 Carbon 9th Gen), - (ThinkPad X1 Yoga 6th Gen)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://support.lenovo.com/us/en/product_security/LEN-77639",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "24.01.2022",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "17.05.2022",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "17.05.2022",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2022-02965",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2021-4212, LEN-77639",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "IdeaPad 3-14ARE05, IdeaPad 3-15ARE05, IdeaPad 3-17ARE05, Ideapad Gaming L340-15IRH, IdeaPad L340-15IWL, Legion Y540-15IRH, Legion Y540-15IRH-PG0, Legion Y540-17IRH, Legion Y540-17IRH-PG0, Legion Y545, Legion Y545-PG0, Legion Y7000-2019, Legion Y7000-2019-PG0, Ideapad S540-13IML, Ideapad Slim 7 Pro-14IHU5, Ideapad Slim 9-14ITL05, V140-15IWL, Yoga 7-14ACN6, Yoga C740-14IML, Yoga C740-15IML, Yoga C940-14IIL, Yoga Slim 7 Pro-14ACH5, Yoga Slim 7 Pro-14ACH5 O, Yoga Slim 7 Pro-14IHU5, Yoga Slim 7 Pro-14IHU5 O, Yoga Slim 7 Pro-14ITL5, Yoga Slim 9-14ITL05, ideapad 3-14IML05, ideapad 3-14ITL05, ideapad 3-14ITL6, ideapad 3-15IML05, ideapad 3-15ITL05, ideapad 3-15ITL6, ideapad 3-17IML05, ideapad 5-15IIL05, ideapad Creator 5-15IMH05, ideapad Gaming 3-15ARH05, ideapad Gaming 3-15IMH05, IdeaPad 3-17ITL6, Lenovo S14 G2 ITL, Lenovo 14W Gen 2, Lenovo 500w Gen 3, ideapad C340-14API, ideapad C340-14IML, ideapad C340-15IML, ideapad D330-10IGM, ideapad Duet 3-10IGL5, Lenovo E41-50, Lenovo E41-55, ideapad FLEX-14IML, ideapad FLEX-15IML, ideapad Flex 3-11ADA05, IdeaPad 3-15IGL05, IdeaPad 3-17IIL05, IdeaPad 5-14ITL05, IdeaPad Gaming 3-15IHU6, Ideapad 5-15ITL05, ideapad L3-15IML05, IdeaPad L3 15ITL6, Legion 5 Pro-16ACH6, Legion 5 Pro-16ACH6H, Legion 5 Pro-16ITH6, Legion 5 Pro-16ITH6H, Legion 5-15ACH6, Legion 5-15ACH6A, Legion 5-15ACH6H, Legion 5-15IMH6, Legion 5-15ITH6, Legion 5-15ITH6H, Legion 5-17ACH6, Legion 5-17ACH6H, Legion 5-17ITH6, Legion 5-17ITH6H, Legion 7-16ACHg6, Legion 7-16ITHg6, Ideapad S145-14IGM, Ideapad S145-14IIL, Ideapad S145-15IGM, Ideapad S145-15IIL, ideapad S340-13IML, ideapad S340-14API, ideapad S340-14IML, ideapad S340-15API, ideapad S340-15API Touch, ideapad S340-15IML, ideapad S340-15IML Touch, ideapad S530-13IML, ideapad S530-13IWL, ideapad S540-14API, ideapad S540-14IML, ideapad S540-14IML Touch, ideapad S540-15IML, ideapad S740-15IRH, ideapad S740-15IRH Touch, ideapad Slim 7-14ARE05, ideapad Slim 7-14IIL05, ideapad Slim 7-14ITL05, ideapad Slim 7-15IIL05, ideapad Slim 7-15IMH05, ideapad Slim 7-15ITL05, ThinkBook 13x ITG, ThinkBook 14 G3 ACL, ThinkBook 14 G3 ITL, ThinkBook 14s Yoga ITL, ThinkBook 15 G3 ACL, ThinkBook Plus G2 ITG, Lenovo V14 G1-IML, Lenovo V14 G2-ITL, Lenovo V14-ARE, Lenovo V14-IGL, Lenovo V14-IIL, Lenovo V15 G1-IML, Lenovo V15 G2-ITL, Lenovo V15-IGL, Lenovo V15-IIL, Lenovo V17 G2-ITL, Lenovo V17-IIL, Lenovo V340-17IWL, Yoga 6-13ALC6, Yoga 730-15IWL, Yoga Creator 7-15IMH05, Yoga Duet 7-13ITL6, Yoga Duet 7-13ITL6-LTE, Yoga S740-15IRH, Yoga Slim 7 Carbon 13ITL5, Yoga Slim 7-13ITL05, Yoga Slim 7-14ARE05, Yoga Slim 7-14IIL05, Yoga Slim 7-14ITL05, Yoga Slim 7-15IIL05, Yoga Slim 7-15IMH05, Yoga Slim 7-15ITL05, ideapad 3-14IGL05, ideapad 3-14IIL05, ideapad 3-15IIL05, ideapad 5 Pro-14ACN6, ideapad 5 Pro-14ITL6, ideapad 5 Pro-16ACH6, ideapad 5 Pro-16IHU6, ideapad 5-14ALC05, ideapad 5-14ARE05, ideapad Creator 5-16ACH6, ideapad Gaming 3-15ACH6, ThinkPad X1 Carbon 9th Gen, ThinkPad X1 Yoga 6th Gen",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0432\u044b\u0437\u043e\u0432\u0430 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430 System Management Interrupt (SMI) \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430 \u0440\u0435\u0436\u0438\u043c\u0430 Legacy BIOS \u043d\u043e\u0443\u0442\u0431\u0443\u043a\u043e\u0432 Lenovo, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0441 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u0430\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0432\u0432\u043e\u0434\u0438\u043c\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 (CWE-20)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0432\u044b\u0437\u043e\u0432\u0430 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430 System Management Interrupt (SMI) \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430 \u0440\u0435\u0436\u0438\u043c\u0430 Legacy BIOS \u043d\u043e\u0443\u0442\u0431\u0443\u043a\u043e\u0432 Lenovo \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u043e\u0439 \u0432\u0432\u043e\u0434\u0438\u043c\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0441 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://support.lenovo.com/us/en/product_security/LEN-77639\nhttps://vuldb.com/?id.198432",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-20",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,8)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,7)"
}

CVE-2021-4212 (GCVE-0-2021-4212)

Vulnerability from cvelistv5 – Published: 2022-04-22 20:30 – Updated: 2024-08-03 17:16

Summary

A potential vulnerability in the SMI callback function used in the Legacy BIOS mode driver in some Lenovo Notebook models may allow an attacker with local access and elevated privileges to execute arbitrary code.

Severity

6.7 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-20 - Improper Input Validation

Assigner

lenovo mitre root Scorecard

References

1 reference

URL	Tags
https://support.lenovo.com/us/en/product_security…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Lenovo	BIOS	Affected: various

Credits

Lenovo thanks Jiawei Yin(@yngweijw) and Menghao Li of IIE varas

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:16:04.273Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://support.lenovo.com/us/en/product_security/LEN-77639"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "BIOS",
          "vendor": "Lenovo",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Lenovo thanks Jiawei Yin(@yngweijw) and Menghao Li of IIE varas"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A potential vulnerability in the SMI callback function used in the Legacy BIOS mode driver in some Lenovo Notebook models may allow an attacker with local access and elevated privileges to execute arbitrary code."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-04-22T20:30:44.000Z",
        "orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
        "shortName": "lenovo"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://support.lenovo.com/us/en/product_security/LEN-77639"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Update system firmware to the version (or newer) indicated for your model in the Product Impact section in LEN-77639."
        }
      ],
      "source": {
        "advisory": "LEN-77639",
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@lenovo.com",
          "ID": "CVE-2021-4212",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "BIOS",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "various"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Lenovo"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Lenovo thanks Jiawei Yin(@yngweijw) and Menghao Li of IIE varas"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A potential vulnerability in the SMI callback function used in the Legacy BIOS mode driver in some Lenovo Notebook models may allow an attacker with local access and elevated privileges to execute arbitrary code."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-20 Improper Input Validation"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://support.lenovo.com/us/en/product_security/LEN-77639",
              "refsource": "MISC",
              "url": "https://support.lenovo.com/us/en/product_security/LEN-77639"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "Update system firmware to the version (or newer) indicated for your model in the Product Impact section in LEN-77639."
          }
        ],
        "source": {
          "advisory": "LEN-77639",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
    "assignerShortName": "lenovo",
    "cveId": "CVE-2021-4212",
    "datePublished": "2022-04-22T20:30:44.000Z",
    "dateReserved": "2022-01-24T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:16:04.273Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

BDU:2022-02965 (CVE-2021-4212)

CVE-2021-4212 (GCVE-0-2021-4212)

Tags

Sightings

Nomenclature

Related by attack behaviour