← Back

CVE-2018-16091

nvd nist
Published: Nov 27, 2018Modified: Nov 21, 2024

JSON object

Loading...
8.1
Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.2 / Impact: 5.9
Source: NVD

Description

In System Management Module (SMM) versions prior to 1.06, the SMM certificate creation and parsing logic is vulnerable to several buffer overflows.

Affected (1)

Lenovo
1 product
System Management Module Firmware
Configuration A
1 vulnerable · 7 platform
Vulnerable SoftwareAffected Versions
System Management Module Firmware
Before 1.06
Running on/withPlatform Versions
Lenovo
Thinkagile Hx Enclosure 7x81
All versions
Lenovo
Thinkagile Hx Enclosure 7y87
All versions
Lenovo
Thinkagile Hx Enclosure 7z02
All versions
Lenovo
Thinkagile Vx Enclosure 7y11
All versions
Lenovo
Thinkagile Vx Enclosure 7y91
All versions
Lenovo
Thinksystem D2 Enclosure 7x20
All versions
Lenovo
Thinksystem Modular Enclosure 7x22
All versions

Related CWEs

CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (2)

Source: psirt@lenovo.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.