Vulnerability-Lookup

BDU:2022-02970 (CVE-2021-4211)

Vulnerability from fstec – Published: 2022-05-17 – Updated: 2022-05-17 – View on bdu.fstec.ru Fixed

Title

Уязвимость функции обратного вызова обработчика System Management Interrupt (SMI) драйвера журнала событий SMBIOS рабочих станций Lenovo ThinkStation, компьютеров Lenovo ThinkEdge и Lenovo Desktop, позволяющая нарушителю выполнить произвольный код с повышенными привилегиями

Summary

Уязвимость функции обратного вызова обработчика System Management Interrupt (SMI) драйвера журнала событий SMBIOS рабочих станций Lenovo ThinkStation, компьютеров Lenovo ThinkEdge и Lenovo Desktop связана с недостаточной проверкой вводимых данных. Эксплуатация уязвимости может позволить нарушителю выполнить произвольный код с повышенными привилегиями

Severity

6.8 (Medium) CVSS 2.0


                      
                        AV:L/AC:L/Au:S/C:C/I:C/A:C

6.7 (Medium) CVSS 3.0


                      
                        CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Resource manipulation

Incidents

Being clarified

Remediation

Software update

CWE

CWE-20 - Недостаточная проверка вводимых данных

Aliases

CVE-2021-4211, LEN-77639

References

2 references

URL
https://support.lenovo.com/us/en/product_security/LEN-77639
https://vuldb.com/?id.198431

Impacted products

72 products from 1 vendor

Vendors

Lenovo Group Limited

Products

IdeaCentre 5-14ACN6, IdeaCentre 5-14IOB6, IdeaCentre AIO 3-22ADA6, IdeaCentre AIO 3-22IIL5, IdeaCentre AIO 3-22ITL6, IdeaCentre AIO 3-24ADA6, IdeaCentre AIO 3-24ALC6, IdeaCentre AIO 3-24IIL5, IdeaCentre AIO 3-24ITL6, IdeaCentre AIO 3-27ITL6, IdeaCentre Creator 5-14IOB6, IdeaCentre Gaming 5-14ACN6, IdeaCentre Gaming 5-14IOB6, ThinkCentre M600, ThinkCentre M700 Thin Client (M700 Desktop Tiny), ThinkCentre M700 Desktop Tiny, ThinkCentre M70a, ThinkCentre M710e, ThinkCentre M710q (type 10YC), ThinkCentre M710q, ThinkCentre M710s, ThinkCentre M710t, ThinkCentre M720e, ThinkCentre M75n, ThinkCentre M800, ThinkCentre M810z All-in-One, ThinkCentre M820z All-in-One, ThinkCentre M900, ThinkCentre M900x, ThinkCentre M90a Gen 2, ThinkCentre M910q, ThinkCentre M910s, ThinkCentre M910t, ThinkCentre M910x, QT M410/B415/M415, ThinkCentre E75 t/s, ThinkCentre M610, ThinkCentre M6600q/t/s, ThinkCentre M700q, ThinkCentre M8600t/s, ideacentre AIO 3-22IMB05, ideacentre AIO 3-24IMB05, ideacentre AIO 3-27IMB05, ideacentre 510S-07ICB, ideacentre 510S-07ICK, ideacentre A340-22ICB, IdeaCentre A340-22ICK, ideacentre A340-22IGM, ideacentre A340-24ICB, IdeaCentre A340-24ICK, ideacentre A340-24IGM, ideacentre A540-24ICB, ideacentre A540-27ICB, ideacentre AIO 520-24ARR, Lenovo V30a-22IML, Lenovo V30a-24IML, Lenovo V410z, Lenovo V50t-13IOB G2, Lenovo V520, Lenovo V530-15ICB, Lenovo V530-15ICR, Lenovo V530s-07ICB, Lenovo V530s-07ICR, Lenovo V540-24IWL, YANGTIAN AfQ150, YTA8900f, ThinkEdge SE30, ThinkStation P310, ThinkStation P320 Tiny, ThinkStation P320, ThinkStation P340, ThinkStation P318

Versions

- (IdeaCentre 5-14ACN6), до M3GKT33A (IdeaCentre 5-14IOB6), до O5CKT21A (IdeaCentre AIO 3-22ADA6), до O56JY22USA (IdeaCentre AIO 3-22IIL5), до O5AJY28A (IdeaCentre AIO 3-22ITL6), до O5CKT21A (IdeaCentre AIO 3-24ADA6), - (IdeaCentre AIO 3-24ALC6), до O56JY22USA (IdeaCentre AIO 3-24IIL5), до O5AJY28A (IdeaCentre AIO 3-24ITL6), до O5AJY28A (IdeaCentre AIO 3-27ITL6), до M3GKT33A (IdeaCentre Creator 5-14IOB6), - (IdeaCentre Gaming 5-14ACN6), до M3GKT33A (IdeaCentre Gaming 5-14IOB6), до M00KT66A (ThinkCentre M600), до FWKTBCA (ThinkCentre M700 Thin Client (M700 Desktop Tiny)), до FWKTBCA (ThinkCentre M700 Desktop Tiny), до M2SKT25A (ThinkCentre M70a), до M1ZKT38A (ThinkCentre M710e), до M1AKT52A (ThinkCentre M710q (type 10YC)), до M1AKT52A (ThinkCentre M710q), до M16KT68A (ThinkCentre M710s), до M16KT68A (ThinkCentre M710t), до M30KT26A (ThinkCentre M720e), до M33KT24A (ThinkCentre M75n), до FWKTBCA (ThinkCentre M800), до M1CKT49A (ThinkCentre M810z All-in-One), до M1NKT58A (ThinkCentre M820z All-in-One), до FWKTBCA (ThinkCentre M900), до FWKTBCA (ThinkCentre M900x), до M3LKT22A (ThinkCentre M90a Gen 2), до M1AKT52A (ThinkCentre M910q), до M1AKT52A (ThinkCentre M910s), до M1AKT52A (ThinkCentre M910t), до M1AKT52A (ThinkCentre M910x), до M16KT68A (QT M410/B415/M415), до M16KT68A (ThinkCentre E75 t/s), до M1AKT52A (ThinkCentre M610), до FWKTBBA (ThinkCentre M6600q/t/s), до FWKTBBA (ThinkCentre M700q), до FWKTBBA (ThinkCentre M8600t/s), - (ideacentre AIO 3-22IMB05), - (ideacentre AIO 3-24IMB05), - (ideacentre AIO 3-27IMB05), до M22KT47A (ideacentre 510S-07ICB), до M30KT26A (ideacentre 510S-07ICK), до O44KT32A (ideacentre A340-22ICB), до O4PKT15USA (IdeaCentre A340-22ICK), - (ideacentre A340-22IGM), до O44KT32A (ideacentre A340-24ICB), до O4PKT15USA (IdeaCentre A340-24ICK), - (ideacentre A340-24IGM), до O49KT38A (ideacentre A540-24ICB), до O48KT32A (ideacentre A540-27ICB), - (ideacentre AIO 520-24ARR), до M37KT28A (Lenovo V30a-22IML), до M37KT28A (Lenovo V30a-24IML), до M17KT49A (Lenovo V410z), до M3GKT33A (Lenovo V50t-13IOB G2), до M16KT68A (Lenovo V520), до M1YKT70A (Lenovo V530-15ICB), до M2YKT31A (Lenovo V530-15ICR), до M22KT47A (Lenovo V530s-07ICB), до M30KT26A (Lenovo V530s-07ICR), до M29KT39A (Lenovo V540-24IWL), до FWKTBBA (YANGTIAN AfQ150), до FWKTBBA (YTA8900f), до M3FKT23A (ThinkEdge SE30), до FWKTBBA (ThinkStation P310), до M1AKT52A (ThinkStation P320 Tiny), до S06KT60A (ThinkStation P320), - (ThinkStation P340), до M1AKT52A (ThinkStation P318)

Product types

Firmware

Mitigations

Использование рекомендаций производителя: https://support.lenovo.com/us/en/product_security/LEN-77639

JSON

To clipboard

{
  "CVSS 2.0": "AV:L/AC:L/Au:S/C:C/I:C/A:C",
  "CVSS 3.0": "AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Lenovo Group Limited",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "- (IdeaCentre 5-14ACN6), \u0434\u043e M3GKT33A (IdeaCentre 5-14IOB6), \u0434\u043e O5CKT21A (IdeaCentre AIO 3-22ADA6), \u0434\u043e O56JY22USA (IdeaCentre AIO 3-22IIL5), \u0434\u043e O5AJY28A (IdeaCentre AIO 3-22ITL6), \u0434\u043e O5CKT21A (IdeaCentre AIO 3-24ADA6), - (IdeaCentre AIO 3-24ALC6), \u0434\u043e O56JY22USA (IdeaCentre AIO 3-24IIL5), \u0434\u043e O5AJY28A (IdeaCentre AIO 3-24ITL6), \u0434\u043e O5AJY28A (IdeaCentre AIO 3-27ITL6), \u0434\u043e M3GKT33A (IdeaCentre Creator 5-14IOB6), - (IdeaCentre Gaming 5-14ACN6), \u0434\u043e M3GKT33A (IdeaCentre Gaming 5-14IOB6), \u0434\u043e M00KT66A (ThinkCentre M600), \u0434\u043e FWKTBCA (ThinkCentre M700 Thin Client (M700 Desktop Tiny)), \u0434\u043e FWKTBCA (ThinkCentre M700 Desktop Tiny), \u0434\u043e M2SKT25A (ThinkCentre M70a), \u0434\u043e M1ZKT38A (ThinkCentre M710e), \u0434\u043e M1AKT52A (ThinkCentre M710q (type 10YC)), \u0434\u043e M1AKT52A (ThinkCentre M710q), \u0434\u043e M16KT68A (ThinkCentre M710s), \u0434\u043e M16KT68A (ThinkCentre M710t), \u0434\u043e M30KT26A (ThinkCentre M720e), \u0434\u043e M33KT24A (ThinkCentre M75n), \u0434\u043e FWKTBCA (ThinkCentre M800), \u0434\u043e M1CKT49A (ThinkCentre M810z All-in-One), \u0434\u043e M1NKT58A (ThinkCentre M820z All-in-One), \u0434\u043e FWKTBCA (ThinkCentre M900), \u0434\u043e FWKTBCA (ThinkCentre M900x), \u0434\u043e M3LKT22A (ThinkCentre M90a Gen 2), \u0434\u043e M1AKT52A (ThinkCentre M910q), \u0434\u043e M1AKT52A (ThinkCentre M910s), \u0434\u043e M1AKT52A (ThinkCentre M910t), \u0434\u043e M1AKT52A (ThinkCentre M910x), \u0434\u043e M16KT68A (QT M410/B415/M415), \u0434\u043e M16KT68A (ThinkCentre E75 t/s), \u0434\u043e M1AKT52A (ThinkCentre M610), \u0434\u043e FWKTBBA (ThinkCentre M6600q/t/s), \u0434\u043e FWKTBBA (ThinkCentre M700q), \u0434\u043e FWKTBBA (ThinkCentre M8600t/s), - (ideacentre AIO 3-22IMB05), - (ideacentre AIO 3-24IMB05), - (ideacentre AIO 3-27IMB05), \u0434\u043e M22KT47A (ideacentre 510S-07ICB), \u0434\u043e M30KT26A (ideacentre 510S-07ICK), \u0434\u043e O44KT32A (ideacentre A340-22ICB), \u0434\u043e O4PKT15USA (IdeaCentre A340-22ICK), - (ideacentre A340-22IGM), \u0434\u043e O44KT32A (ideacentre A340-24ICB), \u0434\u043e O4PKT15USA (IdeaCentre A340-24ICK), - (ideacentre A340-24IGM), \u0434\u043e O49KT38A (ideacentre A540-24ICB), \u0434\u043e O48KT32A (ideacentre A540-27ICB), - (ideacentre AIO 520-24ARR), \u0434\u043e M37KT28A (Lenovo V30a-22IML), \u0434\u043e M37KT28A (Lenovo V30a-24IML), \u0434\u043e M17KT49A (Lenovo V410z), \u0434\u043e M3GKT33A (Lenovo V50t-13IOB G2), \u0434\u043e M16KT68A (Lenovo V520), \u0434\u043e M1YKT70A (Lenovo V530-15ICB), \u0434\u043e M2YKT31A (Lenovo V530-15ICR), \u0434\u043e M22KT47A (Lenovo V530s-07ICB), \u0434\u043e M30KT26A (Lenovo V530s-07ICR), \u0434\u043e M29KT39A (Lenovo V540-24IWL), \u0434\u043e FWKTBBA (YANGTIAN AfQ150), \u0434\u043e FWKTBBA (YTA8900f), \u0434\u043e M3FKT23A (ThinkEdge SE30), \u0434\u043e FWKTBBA (ThinkStation P310), \u0434\u043e M1AKT52A (ThinkStation P320 Tiny), \u0434\u043e S06KT60A (ThinkStation P320), - (ThinkStation P340), \u0434\u043e M1AKT52A (ThinkStation P318)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://support.lenovo.com/us/en/product_security/LEN-77639",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "24.01.2022",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "17.05.2022",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "17.05.2022",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2022-02970",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2021-4211, LEN-77639",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "IdeaCentre 5-14ACN6, IdeaCentre 5-14IOB6, IdeaCentre AIO 3-22ADA6, IdeaCentre AIO 3-22IIL5, IdeaCentre AIO 3-22ITL6, IdeaCentre AIO 3-24ADA6, IdeaCentre AIO 3-24ALC6, IdeaCentre AIO 3-24IIL5, IdeaCentre AIO 3-24ITL6, IdeaCentre AIO 3-27ITL6, IdeaCentre Creator 5-14IOB6, IdeaCentre Gaming 5-14ACN6, IdeaCentre Gaming 5-14IOB6, ThinkCentre M600, ThinkCentre M700 Thin Client (M700 Desktop Tiny), ThinkCentre M700 Desktop Tiny, ThinkCentre M70a, ThinkCentre M710e, ThinkCentre M710q (type 10YC), ThinkCentre M710q, ThinkCentre M710s, ThinkCentre M710t, ThinkCentre M720e, ThinkCentre M75n, ThinkCentre M800, ThinkCentre M810z All-in-One, ThinkCentre M820z All-in-One, ThinkCentre M900, ThinkCentre M900x, ThinkCentre M90a Gen 2, ThinkCentre M910q, ThinkCentre M910s, ThinkCentre M910t, ThinkCentre M910x, QT M410/B415/M415, ThinkCentre E75 t/s, ThinkCentre M610, ThinkCentre M6600q/t/s, ThinkCentre M700q, ThinkCentre M8600t/s, ideacentre AIO 3-22IMB05, ideacentre AIO 3-24IMB05, ideacentre AIO 3-27IMB05, ideacentre 510S-07ICB, ideacentre 510S-07ICK, ideacentre A340-22ICB, IdeaCentre A340-22ICK, ideacentre A340-22IGM, ideacentre A340-24ICB, IdeaCentre A340-24ICK, ideacentre A340-24IGM, ideacentre A540-24ICB, ideacentre A540-27ICB, ideacentre AIO 520-24ARR, Lenovo V30a-22IML, Lenovo V30a-24IML, Lenovo V410z, Lenovo V50t-13IOB G2, Lenovo V520, Lenovo V530-15ICB, Lenovo V530-15ICR, Lenovo V530s-07ICB, Lenovo V530s-07ICR, Lenovo V540-24IWL, YANGTIAN AfQ150, YTA8900f, ThinkEdge SE30, ThinkStation P310, ThinkStation P320 Tiny, ThinkStation P320, ThinkStation P340, ThinkStation P318",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0432\u044b\u0437\u043e\u0432\u0430 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430 System Management Interrupt (SMI) \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430 \u0436\u0443\u0440\u043d\u0430\u043b\u0430 \u0441\u043e\u0431\u044b\u0442\u0438\u0439 SMBIOS \u0440\u0430\u0431\u043e\u0447\u0438\u0445 \u0441\u0442\u0430\u043d\u0446\u0438\u0439 Lenovo ThinkStation, \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043e\u0432 Lenovo ThinkEdge \u0438 Lenovo Desktop, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0441 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u0430\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0432\u0432\u043e\u0434\u0438\u043c\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 (CWE-20)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0432\u044b\u0437\u043e\u0432\u0430 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430 System Management Interrupt (SMI) \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430 \u0436\u0443\u0440\u043d\u0430\u043b\u0430 \u0441\u043e\u0431\u044b\u0442\u0438\u0439 SMBIOS \u0440\u0430\u0431\u043e\u0447\u0438\u0445 \u0441\u0442\u0430\u043d\u0446\u0438\u0439 Lenovo ThinkStation, \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043e\u0432 Lenovo ThinkEdge \u0438 Lenovo Desktop \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u043e\u0439 \u0432\u0432\u043e\u0434\u0438\u043c\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0441 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://support.lenovo.com/us/en/product_security/LEN-77639\nhttps://vuldb.com/?id.198431",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-20",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,8)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,7)"
}

CVE-2021-4211 (GCVE-0-2021-4211)

Vulnerability from cvelistv5 – Published: 2022-04-22 20:30 – Updated: 2024-08-03 17:16

Summary

A potential vulnerability in the SMI callback function used in the SMBIOS event log driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow an attacker with local access and elevated privileges to execute arbitrary code.

Severity

6.7 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-20 - Improper Input Validation

Assigner

lenovo mitre root Scorecard

References

1 reference

URL	Tags
https://support.lenovo.com/us/en/product_security…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Lenovo	BIOS	Affected: various

Credits

Lenovo thanks Jiawei Yin(@yngweijw) and Menghao Li of IIE varas

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:16:04.358Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://support.lenovo.com/us/en/product_security/LEN-77639"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "BIOS",
          "vendor": "Lenovo",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Lenovo thanks Jiawei Yin(@yngweijw) and Menghao Li of IIE varas"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A potential vulnerability in the SMI callback function used in the SMBIOS event log driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow an attacker with local access and elevated privileges to execute arbitrary code."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-04-22T20:30:43.000Z",
        "orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
        "shortName": "lenovo"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://support.lenovo.com/us/en/product_security/LEN-77639"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Update system firmware to the version (or newer) indicated for your model in the Product Impact section in LEN-77639."
        }
      ],
      "source": {
        "advisory": "LEN-77639",
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@lenovo.com",
          "ID": "CVE-2021-4211",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "BIOS",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "various"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Lenovo"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Lenovo thanks Jiawei Yin(@yngweijw) and Menghao Li of IIE varas"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A potential vulnerability in the SMI callback function used in the SMBIOS event log driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow an attacker with local access and elevated privileges to execute arbitrary code."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-20 Improper Input Validation"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://support.lenovo.com/us/en/product_security/LEN-77639",
              "refsource": "MISC",
              "url": "https://support.lenovo.com/us/en/product_security/LEN-77639"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "Update system firmware to the version (or newer) indicated for your model in the Product Impact section in LEN-77639."
          }
        ],
        "source": {
          "advisory": "LEN-77639",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
    "assignerShortName": "lenovo",
    "cveId": "CVE-2021-4211",
    "datePublished": "2022-04-22T20:30:43.000Z",
    "dateReserved": "2022-01-24T00:00:00.000Z",
    "dateUpdated": "2024-08-03T17:16:04.358Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

BDU:2022-02970 (CVE-2021-4211)

CVE-2021-4211 (GCVE-0-2021-4211)

Tags

Sightings

Nomenclature

Related by attack behaviour