CVE-2021-4210

A potential vulnerability in the SMI callback function used in the NVME driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow an attacker with local access and elevated privileges to execute arbitrary code.

Score

CVSS 3.1 6.7 Medium

Status

Modified - psirt@lenovo.com

Published

2022-04-22

Last modified

2024-08-03

Weaknesses

CWE-20

Affected products

• A540-24icb Firmware (Lenovo)
• A540-27icb Firmware (Lenovo)
• Bios (Lenovo)
• Ideacentre 5-14imb05 Firmware (Lenovo)
• Ideacentre Aio 3-22ada6 Firmware (Lenovo)
• Ideacentre Aio 3-22iil5 Firmware (Lenovo)
• Ideacentre Aio 3-22itl6 Firmware (Lenovo)
• Ideacentre Aio 3-24ada6 Firmware (Lenovo)
• Ideacentre Aio 3-24iil5 Firmware (Lenovo)
• Ideacentre Aio 3-24itl6 Firmware (Lenovo)
• Ideacentre Aio 3-27itl6 Firmware (Lenovo)
• Ideacentre C5-14imb05 Firmware (Lenovo)
• Ideacentre G5-14imb05 Firmware (Lenovo)
• Stadia Ggp-120 Firmware (Lenovo)
• Thinkcentre M700 Firmware (Lenovo)
• Thinkcentre M700 Tiny Firmware (Lenovo)
• Thinkcentre M70a Firmware (Lenovo)
• Thinkcentre M75n Firmware (Lenovo)
• Thinkcentre M800 Firmware (Lenovo)
• Thinkcentre M810z Firmware (Lenovo)
• Thinkcentre M820z Firmware (Lenovo)
• Thinkcentre M900 Firmware (Lenovo)
• Thinkcentre M900x Firmware (Lenovo)
• Thinkcentre M90a Gen2 Firmware (Lenovo)
• Thinkcentre M910z Firmware (Lenovo)
• Thinkcentre X1 Firmware (Lenovo)
• Thinkedge Se30 Firmware (Lenovo)
• Thinkstation P310 Firmware (Lenovo)
• Thinkstation P520 Firmware (Lenovo)
• Thinkstation P520c Firmware (Lenovo)
• V410z Firmware (Lenovo)
• V50t-13imb Firmware (Lenovo)
• V540-24iwl Firmware (Lenovo)

References

• https://support.lenovo.com/us/en/product_security/LEN-77639