medium4.4
CVE-2021-3786
A potential vulnerability in the SMI callback function used in CSME configuration of some Lenovo Notebook and ThinkPad systems could be used to leak out data o…
Impact
A potential vulnerability in the SMI callback function used in CSME configuration of some Lenovo Notebook and ThinkPad systems could be used to leak out data out of the SMRAM range.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Lenovo | Thinkpad X380 Yoga Firmware | before 2020-10-31 |
| Lenovo | Thinkpad X1 Fold Gen 1 Firmware | before 2021-10-29 |
| Lenovo | Thinkpad Yoga 260 Firmware | before 2021-10-25 |
| Lenovo | Thinkpad Yoga 11e 3rd Gen Firmware | before 2021-10-31 |
| Lenovo | Thinkpad Yoga 15 Firmware | before n19et66w |
| Lenovo | Thinkpad Yoga 370 Firmware | before 2021-10-31 |
| Lenovo | Thinkpad X12 Detachable Gen 1 Firmware | before 2021-10-31 |
| Lenovo | Thinkpad X390 Firmware | before n2jet96w |
| Lenovo | Thinkpad Yoga 11e 4th Gen Firmware | before 2021-10-31 |
| Lenovo | Thinkpad Yoga 11e 5th Gen Firmware | before 2021-10-31 |
| Lenovo | Thinkpad X250 Firmware | before 2021-10-31 |
| Lenovo | Thinkpad X260 Firmware | before 2021-10-31 |