Out-of-bounds Read in Lenovo Bios
CVE-2022-40136
An information leak vulnerability in SMI Handler used to configure platform settings over WMI in some Lenovo models may allow an attacker with local access and elevated privileges to read SMM memory.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.4 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.002 (9.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 9th percentile — 9.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- Lenovo Bios — versions various
- Lenovo Ideacentre 3-07ada05
- Lenovo Ideacentre 3-07ada05 Firmware
- Lenovo Ideacentre 3 07iab7
- Lenovo Ideacentre 3 07iab7 Firmware
- Lenovo Ideacentre 3-07imb05
- Lenovo Ideacentre 3-07imb05 Firmware
- Lenovo Ideacentre 510-15ick
- Lenovo Ideacentre 510-15ick Firmware
- Lenovo Ideacentre 510a-15arr
Weakness classification (CWE)
References
- support.lenovo.com/us/en/product_security/LEN-94953 (Vendor Advisory)
Frequently asked questions
- What is CVE-2022-40136?
- CVE-2022-40136 is a medium-severity vulnerability in Lenovo Bios, classified under Out-of-bounds Read. CVSS score: 4.4/10. Published 2023-01-30.
- How severe is CVE-2022-40136?
- Medium severity. CVSS v3 base score is 4.4 out of 10.