CVE-2021-3843

Published: Nov 12, 2021Modified: Jun 17, 2026

6.7

Vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 0.8 / Impact: 5.9

Source: NVD

Description

A potential vulnerability in the SMI function to access EEPROM in some ThinkPad models may allow an attacker with local access and elevated privileges to execute arbitrary code.

Affected (32)

Lenovo

29 products

Thinkpad 11e 3rd Gen Firmware

Thinkpad 11e 4th Gen I3 Firmware

Thinkpad 11e 4th Gen I7 Firmware

Thinkpad 11e 4th Gen I5 Firmware

Thinkpad 11e 4th Gen Celeron Firmware

Thinkpad 11e Yoga Gen 6 Firmware

Thinkpad 13 Gen 2 Firmware

Thinkpad L13 Firmware

Thinkpad L13 Gen 2 Firmware

Thinkpad L13 Yoga Firmware

Thinkpad L13 Yoga Gen 2 Firmware

Thinkpad L14 Gen 1 Firmware

Thinkpad L14 Firmware

Thinkpad L15 Gen 1 Firmware

Thinkpad L15 Firmware

Thinkpad L380 Firmware

Thinkpad L380 Yoga Firmware

Thinkpad L390 Yoga Firmware

Thinkpad L390 Firmware

Thinkpad S5 2nd Gen Firmware

Thinkpad T460 Firmware

Thinkpad S2 Gen 6 Firmware

Thinkpad S2 Yoga Gen 6 Firmware

Thinkpad X12 Detachable Gen 1 Firmware

Thinkpad X260 Firmware

Thinkpad X380 Yoga Firmware

Thinkpad X390 Yoga Firmware

Thinkpad 11e 5th Gen Firmware

Thinkpad X1 Fold Gen 1 Firmware

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Lenovo Thinkpad 11e 3rd Gen Firmware	Up to 1.22

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad 11e 3rd Gen Firmware	Up to 1.29

Running on/with	Platform Versions
Lenovo Thinkpad 11e 3rd Gen	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad 11e 4th Gen I3 Firmware	Up to 1.22

Running on/with	Platform Versions
Lenovo Thinkpad 11e 4th Gen I3	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad 11e 4th Gen I7 Firmware	Up to 1.22

Running on/with	Platform Versions
Lenovo Thinkpad 11e 4th Gen I7	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad 11e 4th Gen I5 Firmware	Up to 1.22

Running on/with	Platform Versions
Lenovo Thinkpad 11e 4th Gen I5	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad 11e 4th Gen Celeron Firmware	Up to 1.27

Running on/with	Platform Versions
Lenovo Thinkpad 11e 4th Gen Celeron	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad 11e Yoga Gen 6 Firmware	Up to 1.12

Running on/with	Platform Versions
Lenovo Thinkpad 11e Yoga Gen 6	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad 13 Gen 2 Firmware	Up to 1.29

Running on/with	Platform Versions
Lenovo Thinkpad 13 Gen 2	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad L13 Firmware	Up to 1.31

Running on/with	Platform Versions
Lenovo Thinkpad L13	All versions

Configuration J

1 vulnerable

Vulnerable Software	Affected Versions
Lenovo Thinkpad L13 Gen 2 Firmware	Up to 1.11

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad L13 Gen 2 Firmware	Up to 1.08

Running on/with	Platform Versions
Lenovo Thinkpad L13 Gen 2	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad L13 Yoga Firmware	Up to 1.31

Running on/with	Platform Versions
Lenovo Thinkpad L13 Yoga	All versions

Configuration M

1 vulnerable

Vulnerable Software	Affected Versions
Lenovo Thinkpad L13 Yoga Gen 2 Firmware	Up to 1.11

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad L13 Yoga Gen 2 Firmware	Up to 1.08

Running on/with	Platform Versions
Lenovo Thinkpad L13 Yoga Gen 2	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad L14 Gen 1 Firmware	Before 1.15

Running on/with	Platform Versions
Lenovo Thinkpad L14 Gen 1	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad L14 Firmware	Before 1.20.1.17

Running on/with	Platform Versions
Lenovo Thinkpad L14	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad L15 Gen 1 Firmware	Before 1.15

Running on/with	Platform Versions
Lenovo Thinkpad L15 Gen 1	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad L15 Firmware	Before 1.20.1.17

Running on/with	Platform Versions
Lenovo Thinkpad L15	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad L380 Firmware	Up to 1.26

Running on/with	Platform Versions
Lenovo Thinkpad L380	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad L380 Yoga Firmware	Up to 1.26

Running on/with	Platform Versions
Lenovo Thinkpad L380 Yoga	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad L390 Yoga Firmware	Up to 1.35

Running on/with	Platform Versions
Lenovo Thinkpad L390 Yoga	All versions

Configuration V

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad L390 Firmware	Up to 1.35

Running on/with	Platform Versions
Lenovo Thinkpad L390	All versions

Configuration W

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad S5 2nd Gen Firmware	Up to 1.28

Running on/with	Platform Versions
Lenovo Thinkpad S5 2nd Gen	All versions

Configuration X

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad T460 Firmware	Up to 1.43.1.11

Running on/with	Platform Versions
Lenovo Thinkpad T460	All versions

Configuration Y

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad S2 Gen 6 Firmware	Up to 2021-09-30

Running on/with	Platform Versions
Lenovo Thinkpad S2 Gen 6	All versions

Configuration Z

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad S2 Yoga Gen 6 Firmware	Up to 2021-09-30

Running on/with	Platform Versions
Lenovo Thinkpad S2 Yoga Gen 6	All versions

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad X12 Detachable Gen 1 Firmware	Before 1.16

Running on/with	Platform Versions
Lenovo Thinkpad X12 Detachable Gen 1	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad X260 Firmware	Up to 1.47\/1.15

Running on/with	Platform Versions
Lenovo Thinkpad X260	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad X380 Yoga Firmware	Up to 1.34

Running on/with	Platform Versions
Lenovo Thinkpad X380 Yoga	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad X390 Yoga Firmware	Before n2let87w

Running on/with	Platform Versions
Lenovo Thinkpad X390 Yoga	All versions

Configuration E

1 platform

Running on/with	Platform Versions
Lenovo Thinkpad 11e 5th Gen	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad 11e 5th Gen Firmware	Up to 1.13

Running on/with	Platform Versions
Lenovo Thinkpad Yoga 370	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad X1 Fold Gen 1 Firmware	Before n2pet50w

Running on/with	Platform Versions
Lenovo Thinkpad X1 Fold Gen 1	All versions

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (2)

https://support.lenovo.com/us/en/product_security/LEN-72619

Source: psirt@lenovo.com

Vendor Advisory

https://support.lenovo.com/us/en/product_security/LEN-72619

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.