CVE-2022-1107 — Improper Input Validation in Lenovo Thinkpad 11E Firmware

CWE-20 — Improper Input ValidationCWE-269 — Improper Privilege Management3 documents3 sources
Severity
6.7MEDIUMNVD
EPSS
0.0%
top 90.74%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
31
Lenovo Thinkpad 11E FirmwareLenovo Thinkpad 11E Yoga FirmwareLenovo Thinkpad Helix Firmware+28 more
Timeline
PublishedApr 22
Latest updateApr 23

Description

During an internal product security audit a potential vulnerability due to use of Boot Services in the SmmOEMInt15 SMI handler was discovered in some ThinkPad models could be exploited by an attacker with elevated privileges that could allow for execution of code.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 0.8 | Impact: 5.9

Affected Packages31 packages

🔴Vulnerability Details

2
GHSA
GHSA-qmwg-7c3h-jmrr: A potential vulnerability due to use of Boot Services in the SmmOEMInt15 SMI handler in some ThinkPad models could be exploited by an attacker with el↗2022-04-23
▶
CVEList
CVE-2022-1107: During an internal product security audit a potential vulnerability due to use of Boot Services in the SmmOEMInt15 SMI handler was discovered in some↗2022-04-22
▶
CVE-2022-1107 — Improper Input Validation in Lenovo | cvebase