Out-of-bounds Read in Lenovo Bios
CVE-2022-40136
An information leak vulnerability in SMI Handler used to configure platform settings over WMI in some Lenovo models may allow an attacker with local access and elevated privileges to read SMM memory.
Vulnerability class: Buffer Overflow
EPSS: 0.002 (9.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.4 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Lenovo Bios — versions various
- Lenovo Ideacentre_3-07ada05
- Lenovo Ideacentre_3-07ada05_firmware
- Lenovo Ideacentre_3_07iab7
- Lenovo Ideacentre_3_07iab7_firmware
- Lenovo Ideacentre_3-07imb05
- Lenovo Ideacentre_3-07imb05_firmware
- Lenovo Ideacentre_510-15ick
- Lenovo Ideacentre_510-15ick_firmware
- Lenovo Ideacentre_510a-15arr
Weakness classification (CWE)
References
- psirt@lenovo.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2022-40136?
- CVE-2022-40136 is a medium-severity vulnerability in Lenovo Bios, classified under Out-of-bounds Read. CVSS score: 4.4/10. Published 2023-01-30.
- How severe is CVE-2022-40136?
- Medium severity. CVSS v3 base score is 4.4 out of 10.