Vulnerability · Published Nov 12, 2021 · Assigned by lenovo
CVE-2021-3786
Medium 4.4
In plain English
A medium-severity improper input validation in Notebook and ThinkPad BIOS from Lenovo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).
Severity (CVSS 3.1)4.4Medium
Exploit odds (30 days)0.2%top 85.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A potential vulnerability in the SMI callback function used in CSME configuration of some Lenovo Notebook and ThinkPad systems could be used to leak out data out of the SMRAM range.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Lenovo | Notebook and ThinkPad BIOS | various |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
References
- https://support.lenovo.com/us/en/product_security/LEN-67440 x_refsource_MISC