medium6.7
CVE-2021-3599
A potential vulnerability in the SMI callback function used to access flash device in some ThinkPad models may allow an attacker with local access and elevated…
Impact
A potential vulnerability in the SMI callback function used to access flash device in some ThinkPad models may allow an attacker with local access and elevated privileges to execute arbitrary code.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Lenovo | Thinkpad X380 Yoga Firmware | before 2020-10-31 |
| Lenovo | Thinkpad X1 Fold Gen 1 Firmware | before 2021-10-29 |
| Lenovo | Thinkpad Yoga 260 Firmware | before 2021-10-25 |
| Lenovo | Thinkpad Yoga 11e 3rd Gen Firmware | before 2021-10-31 |
| Lenovo | Thinkpad Yoga 15 Firmware | before n19et66w |
| Lenovo | Thinkpad Yoga 370 Firmware | before 2021-10-31 |
| Lenovo | Thinkpad X12 Detachable Gen 1 Firmware | before 2021-10-31 |
| Lenovo | Thinkpad X390 Firmware | before n2jet96w |
| Lenovo | Thinkpad Yoga 11e 4th Gen Firmware | before 2021-10-31 |
| Lenovo | Thinkpad Yoga 11e 5th Gen Firmware | before 2021-10-31 |
| Lenovo | Thinkpad X250 Firmware | before 2021-10-31 |
| Lenovo | Thinkpad X260 Firmware | before 2021-10-31 |