CVE-2019-6156

CWE-6673 documents3 sources
Severity
3.3LOW
EPSS
0.0%
top 87.02%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
78
Lenovo 330-14igm FirmwareLenovo 330-15igm FirmwareLenovo Aio300-23isu\(c5130\) Firmware+75 more
Timeline
PublishedApr 10
Latest updateMay 13

Description

In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash. While this provides sufficient protection, an additional layer of protection is provided by SPI Protected Range Registers (PRx). Lenovo was notified that after resuming from S3 sleep mode in various versions of BIOS for Lenovo systems, the PRx is not set. This does not impact the SMM BIOS Write Protection, which keeps systems protected.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NExploitability: 1.8 | Impact: 1.4

Affected Packages78 packages

▶CVEListV5lenovo/biosvarious
▶NVDlenovo/thinkpad_s5_firmware< r0met46w+1

Patches

Patch: support.lenovo.com ↗Patch: support.lenovo.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-9wmj-xcgw-57p9: In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash↗2022-05-13
▶
CVEList
CVE-2019-6156: In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash↗2019-04-10
▶