PT-2016-7469 · Lenovo · Thinkpad

Publicado 2016-11-30 · Atualizado 2016-12-06 · CVE-2016-8222

Positive Technologies (AI Summary)

CVSS v2.0

4.7

Média

Vetor base

AV:L/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Lenovo ThinkPad systems (affected versions not specified)

Description A vulnerability has been identified in a signed kernel driver for the BIOS of some ThinkPad systems. This issue can allow an attacker with Windows administrator-level privileges to call System Management Mode (SMM) services, potentially leading to a denial of service attack. It may also enable the alteration of certain BIOS variables or settings, such as the boot sequence. However, the setting or changing of BIOS passwords is not affected by this issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2016-8222

Produtos afetados

Thinkpad

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2016-8222 · Nota de Segurança
• http://securityfocus.com/bid/94409 · Nota
• https://support.lenovo.com/us/en/solutions/LEN_8327 · Aviso do Fabricante