description: An information leak vulnerability in SMI Handler used to configure platform settings over WMI in some Lenovo models may allow an attacker with local access and elevated privileges to read SMM memory.
problem types: CWE-125 Out-of-bounds Read
affected:
{
defaultStatus: unaffected
product: BIOS
vendor: Lenovo
versions:
status: affected, version: various
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Update system firmware to the version (or newer) indicated for your model in the Product Impact section of LEN-94953.