CVE-2022-1107

Published: Apr 22, 2022Modified: Jun 17, 2026

6.7

Vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 0.8 / Impact: 5.9

Source: NVD

Description

During an internal product security audit a potential vulnerability due to use of Boot Services in the SmmOEMInt15 SMI handler was discovered in some ThinkPad models could be exploited by an attacker with elevated privileges that could allow for execution of code.

Affected (30)

Lenovo

30 products

Thinkpad 11e Firmware

Thinkpad Helix Firmware

Thinkpad L560 Firmware

Thinkpad L570 Firmware

Thinkpad P50s Firmware

Thinkpad P51s Firmware

Thinkpad P52s Firmware

Thinkpad S540 Firmware

Thinkpad T550 Firmware

Thinkpad T560 Firmware

Thinkpad T570 Firmware

Thinkpad T580 Firmware

Thinkpad X1 Tablet Gen 1 Firmware

Thinkpad X1 Tablet Gen 2 Firmware

Thinkpad W540 Firmware

Thinkpad W541 Firmware

Thinkpad W550s Firmware

Thinkpad X1 Carbon 3rd Gen Firmware

Thinkpad X1 Carbon 4th Gen Firmware

Thinkpad X1 Carbon 5th Gen Kabylake Firmware

Thinkpad X1 Carbon 5th Gen Skylake Firmware

Thinkpad X1 Yoga Firmware

Thinkpad X1 Yoga Gen 2 Firmware

Thinkpad X1 Yoga Gen 3 Firmware

Thinkpad X250 Firmware

Thinkpad X280 Firmware

Thinkpad X390 Firmware

Thinkpad 11e Yoga Firmware

Thinkpad Yoga 15 Firmware

Thinkpad Yoga 260 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad 11e Firmware	version < n15et78w

Running on/with	Platform Versions
Lenovo Thinkpad 11e	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad Helix Firmware	version < n17eta8w

Running on/with	Platform Versions
Lenovo Thinkpad Helix	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad L560 Firmware	version < n1het85w

Running on/with	Platform Versions
Lenovo Thinkpad L560	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad L570 Firmware	version < n1xet65w

Running on/with	Platform Versions
Lenovo Thinkpad L570	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad P50s Firmware	version < n1ket46w

Running on/with	Platform Versions
Lenovo Thinkpad P50s	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad P51s Firmware	version < n1vet50w

Running on/with	Platform Versions
Lenovo Thinkpad P51s	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad P52s Firmware	version < n27et36w

Running on/with	Platform Versions
Lenovo Thinkpad P52s	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad S540 Firmware	version < gpet80ww

Running on/with	Platform Versions
Lenovo Thinkpad S540	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad T550 Firmware	version < n11et50w

Running on/with	Platform Versions
Lenovo Thinkpad T550	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad T560 Firmware	version < n1ket46w

Running on/with	Platform Versions
Lenovo Thinkpad T560	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad T570 Firmware	version < n1vet50w

Running on/with	Platform Versions
Lenovo Thinkpad T570	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad T580 Firmware	version < n27et36w

Running on/with	Platform Versions
Lenovo Thinkpad T580	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad X1 Tablet Gen 1 Firmware	version < n1let86w

Running on/with	Platform Versions
Lenovo Thinkpad X1 Tablet Gen 1	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad X1 Tablet Gen 2 Firmware	version < n1oet50w

Running on/with	Platform Versions
Lenovo Thinkpad X1 Tablet Gen 2	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad W540 Firmware	version < gnet92ww

Running on/with	Platform Versions
Lenovo Thinkpad W540	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad W541 Firmware	version < gnet92ww

Running on/with	Platform Versions
Lenovo Thinkpad W541	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad W550s Firmware	version < n11et50w

Running on/with	Platform Versions
Lenovo Thinkpad W550s	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad X1 Carbon 3rd Gen Firmware	version < n14et52w

Running on/with	Platform Versions
Lenovo Thinkpad X1 Carbon 3rd Gen	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad X1 Carbon 4th Gen Firmware	version < n1fet70w

Running on/with	Platform Versions
Lenovo Thinkpad X1 Carbon 4th Gen	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad X1 Carbon 5th Gen Kabylake Firmware	version < n1met55w

Running on/with	Platform Versions
Lenovo Thinkpad X1 Carbon 5th Gen Kabylake	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad X1 Carbon 5th Gen Skylake Firmware	version < n1met55w

Running on/with	Platform Versions
Lenovo Thinkpad X1 Carbon 5th Gen Skylake	All versions

Configuration V

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad X1 Yoga Firmware	version < n1fet70w

Running on/with	Platform Versions
Lenovo Thinkpad X1 Yoga	All versions

Configuration W

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad X1 Yoga Gen 2 Firmware	version < n1net47w

Running on/with	Platform Versions
Lenovo Thinkpad X1 Yoga Gen 2	All versions

Configuration X

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad X1 Yoga Gen 3 Firmware	version < n25et50w

Running on/with	Platform Versions
Lenovo Thinkpad X1 Yoga Gen 3	All versions

Configuration Y

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad X250 Firmware	version < n10et58w

Running on/with	Platform Versions
Lenovo Thinkpad X250	All versions

Configuration Z

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad X280 Firmware	version < n20et44w

Running on/with	Platform Versions
Lenovo Thinkpad X280	All versions

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad X390 Firmware	version < n2let60w

Running on/with	Platform Versions
Lenovo Thinkpad X390	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad 11e Yoga Firmware	version < n15et78w

Running on/with	Platform Versions
Lenovo Thinkpad 11e Yoga	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad Yoga 15 Firmware	version < n19et61w

Running on/with	Platform Versions
Lenovo Thinkpad Yoga 15	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad Yoga 260 Firmware	version < n1get98w

Running on/with	Platform Versions
Lenovo Thinkpad Yoga 260	All versions

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CWE-269

Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

References (2)

https://support.lenovo.com/us/en/product_security/LEN-84943

Source: psirt@lenovo.com

Vendor Advisory

https://support.lenovo.com/us/en/product_security/LEN-84943

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.