CVE-2022-1108

A potential vulnerability due to improper buffer validation in the SMI handler LenovoFlashDeviceInterface in Thinkpad X1 Fold Gen 1 could be exploited by an attacker with local access and elevated privileges to execute arbitrary code.

Score

CVSS 3.1 6.7 Medium

Status

Modified - psirt@lenovo.com

Published

2022-04-22

Last modified

2024-08-02

Weaknesses

CWE-20, CWE-269

Affected products

• Thinkpad Bios (Lenovo)
• Thinkpad X1 Fold Gen 1 Firmware (Lenovo)

References

• https://support.lenovo.com/us/en/product_security/LEN-84943