Out-of-bounds Read in Lenovo Bios
CVE-2022-40134
An information leak vulnerability in the SMI Set BIOS Password SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to read SMM memory.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.4 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.002 (9.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 9th percentile — 9.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- Lenovo Bios — versions various
- Lenovo Ideacentre 3-07ada05
- Lenovo Ideacentre 3-07ada05 Firmware — versions o4fkt29a
- Lenovo Ideacentre 3 07iab7
- Lenovo Ideacentre 3 07iab7 Firmware — versions m49kt1da
- Lenovo Ideacentre 3-07imb05
- Lenovo Ideacentre 3-07imb05 Firmware — versions m2vkt1da
- Lenovo Ideacentre 510s-07icb
- Lenovo Ideacentre 510s-07icb Firmware — versions m22kt47a, m22kt48a
- Lenovo Ideacentre 510s-07ick
Weakness classification (CWE)
References
- support.lenovo.com/us/en/product_security/LEN-94953 (Vendor Advisory)
Frequently asked questions
- What is CVE-2022-40134?
- CVE-2022-40134 is a medium-severity vulnerability in Lenovo Bios, classified under Out-of-bounds Read. CVSS score: 4.4/10. Published 2023-01-30.
- How severe is CVE-2022-40134?
- Medium severity. CVSS v3 base score is 4.4 out of 10.