description: A potential vulnerability in the SMI callback function used in CSME configuration of some Lenovo Notebook and ThinkPad systems could be used to leak out data out of the SMRAM range.
problem types: CWE-20 Improper Input Validation
affected:
{
product: Notebook and ThinkPad BIOS
vendor: Lenovo
versions:
status: affected, version: various
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 4.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
version: 3.1
]
solutions: Update system firmware to the version (or newer) indicated for your model in the Product Impact section of LEN-67440.