CVE-2020-8341

published 2020-09-01

CVE-2020-8341: In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash. While this provides sufficient protection, an additional layer of…

Priority P4 7 low 2.4 CVSS 3.1

AV P AC L PR N UI N S U C N I L A N

In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash. While this provides sufficient protection, an additional layer of protection is provided by SPI Protected Range Registers (PRx). After resuming from S3 sleep mode in various versions of BIOS for some Lenovo ThinkPad systems, the PRx is not set. This does not impact the SMM BIOS Write Protection, which keeps systems protected.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
lenovo	thinkpad	—	—
lenovo	thinkpad_t490_firmware	< n2iet90w	n2iet90w
lenovo	thinkpad_t490_firmware	< n2ret16w	n2ret16w
lenovo	thinkpad_t490s_firmware	< n2jet89w	n2jet89w
lenovo	thinkpad_t495_drift_firmware	< 2020-08-30	2020-08-30
lenovo	thinkpad_t590_firmware	< n2iet90w	n2iet90w
lenovo	thinkpad_x1_carbon_firmware	< n2het54w	n2het54w
lenovo	thinkpad_x1_yoga_firmware	< n2het54w	n2het54w
lenovo	thinkpad_x390_firmware	< n2jet89w	n2jet89w
lenovo	thinkpad_x390_firmware	< n2set18w	n2set18w

CVSS provenance

nvd v3.1 2.4 LOW CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

nvd v2.0 2.1 LOW AV:L/AC:L/Au:N/C:N/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.