Lenovo Thinkpad vulnerabilities

CVE-2023-4030 [HIGH] CWE-636 CVE-2023-4030: A vulnerability was reported in BIOS for ThinkPad P14s Gen 2, P15s Gen 2, T14 Gen 2, and T15 Gen 2 t A vulnerability was reported in BIOS for ThinkPad P14s Gen 2, P15s Gen 2, T14 Gen 2, and T15 Gen 2 that could cause the system to recover to insecure settings if the BIOS becomes corrupt.

CVE-2023-4029 [MEDIUM] CWE-120 CVE-2023-4029: A buffer overflow has been identified in the BoardUpdateAcpiDxe driver in some Lenovo ThinkPad produ A buffer overflow has been identified in the BoardUpdateAcpiDxe driver in some Lenovo ThinkPad products which may allow an attacker with local access and elevated privileges to execute arbitrary code.

CVE-2023-2290 [MEDIUM] CWE-787 CVE-2023-2290: A potential vulnerability in the LenovoFlashDeviceInterface SMI handler may allow an attacker with l A potential vulnerability in the LenovoFlashDeviceInterface SMI handler may allow an attacker with local access and elevated privileges to execute arbitrary code.

CVE-2020-8341 [LOW] CVE-2020-8341: In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash. While this prov In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash. While this provides sufficient protection, an additional layer of protection is provided by SPI Protected Range Registers (PRx). After resuming from S3 sleep mode in various versions of BIOS for some Lenovo ThinkPad systems, the PRx is not set. This does not impact the SMM BIOS

CVE-2019-6172 [MEDIUM] CVE-2019-6172: A potential vulnerability in the SMI callback function used in Legacy USB driver using passed parame A potential vulnerability in the SMI callback function used in Legacy USB driver using passed parameter without sufficient checking in some Lenovo ThinkPad models may allow arbitrary code execution.

CVE-2019-6170 [MEDIUM] CVE-2019-6170: A potential vulnerability in the SMI callback function used in the Legacy USB driver using boot serv A potential vulnerability in the SMI callback function used in the Legacy USB driver using boot services structure in runtime phase in some Lenovo ThinkPad models may allow arbitrary code execution.

CVE-2007-1307 [CRITICAL] CVE-2007-1307: Unspecified vulnerability in Lenovo Intel PRO/1000 LAN adapter before Build 135400, as used on IBM L Unspecified vulnerability in Lenovo Intel PRO/1000 LAN adapter before Build 135400, as used on IBM Lenovo ThinkPad systems, has unknown impact and attack vectors.