PT-2022-2247 · Lenovo · Thinkpad

Published 2022-04-12 · Updated 2022-05-12 · CVE-2022-1107

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ThinkPad models (affected versions not specified)

Description A potential issue was discovered in the SmmOEMInt15 SMI handler due to the use of Boot Services, which could be exploited by an attacker with elevated privileges to execute code. This issue is related to the BIOS firmware of ThinkPad laptops and is associated with bypassing introduced security restrictions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

RCE

Weakness Enumeration

CWE-269

CWE-264

CWE-20

Related Identifiers

BDU:2022-02345

CVE-2022-1107

Affected Products

Thinkpad

References · 8

• https://osv.dev/vulnerability/CVE-2022-1107 · Vendor Advisory
• https://support.lenovo.com/us/en/product_security/LEN-84943 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02345 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-1107 · Security Note
• https://support.lenovo.com/us/en/product_security/LEN-84943#ThinkPad · Note
• https://t.me/cibsecurity/41354 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2022041313 · Note
• https://t.me/cvenotify/30094 · Telegram Post