PT-2016-7469 · Lenovo · Thinkpad

Published 2016-11-30 · Updated 2016-12-06 · CVE-2016-8222

Positive Technologies (AI Summary)

CVSS v2.0

4.7

Medium

Base vector

AV:L/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Lenovo ThinkPad systems (affected versions not specified)

Description A vulnerability has been identified in a signed kernel driver for the BIOS of some ThinkPad systems. This issue can allow an attacker with Windows administrator-level privileges to call System Management Mode (SMM) services, potentially leading to a denial of service attack. It may also enable the alteration of certain BIOS variables or settings, such as the boot sequence. However, the setting or changing of BIOS passwords is not affected by this issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2016-8222

Affected Products

Thinkpad

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2016-8222 · Security Note
• https://support.lenovo.com/us/en/solutions/LEN_8327 · Vendor Advisory
• http://securityfocus.com/bid/94409 · Note