Improper Buffer Validation in Lenovo Flash Device Interface for ThinkPad
CVE-2022-1108

6.7MEDIUM

Key Information:

Vendor
Lenovo
Status
Thinkpad Bios
Vendor
CVE Published:
22 April 2022

Summary

A vulnerability exists in the Lenovo Flash Device Interface within the ThinkPad X1 Fold Gen 1, where improper buffer validation can be exploited. An attacker with local access and elevated privileges could potentially execute arbitrary code, posing significant risks to system integrity and security.

Affected Version(s)

ThinkPad BIOS various

References

https://support.lenovo.com/us/en/product_security/LEN-84943
x_refsource_MISC

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lenovo thanks Jiawei Yin(@yngweijw) and Menghao Li of IIE varas
.