CVE-2022-4574 — MEDIUM (6.7)

Q: What is CVE-2022-4574?

CVE-2022-4574 is a vulnerability with a CVSS score of 6.7 (MEDIUM). An SMI handler input validation vulnerability in the BIOS of some ThinkPad models could allow an attacker with local access and elevated privileges to execute arbitrary code.

Q: How severe is CVE-2022-4574?

CVE-2022-4574 has been rated MEDIUM with a CVSS base score of 6.7/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2022-4574?

Check the references section above for vendor advisories and patch information. Affected products include: Lenovo Thinkpad X13 Yoga Gen 2 Firmware, Lenovo Thinkpad X13 Yoga Gen 2, Lenovo Thinkpad X13 Yoga Gen 1 Firmware, Lenovo Thinkpad X13 Yoga Gen 1, Lenovo Thinkpad X13 Gen 3 Firmware.

Vulnerability Description

An SMI handler input validation vulnerability in the BIOS of some ThinkPad models could allow an attacker with local access and elevated privileges to execute arbitrary code.

CVSS Score

6.7

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Lenovo	Thinkpad X13 Yoga Gen 2 Firmware	< 1.40
Lenovo	Thinkpad X13 Yoga Gen 2	-
Lenovo	Thinkpad X13 Yoga Gen 1 Firmware	< 1.45
Lenovo	Thinkpad X13 Yoga Gen 1	-
Lenovo	Thinkpad X13 Gen 3 Firmware	< 1.33
Lenovo	Thinkpad X13 Gen 3	-
Lenovo	Thinkpad X13 Gen 2 Firmware	< 1.51
Lenovo	Thinkpad X13 Gen 2	-
Lenovo	Thinkpad X13 Firmware	< 1.26
Lenovo	Thinkpad X13	-
Lenovo	Thinkpad X1 Yoga 7Th Gen Firmware	< 1.37
Lenovo	Thinkpad X1 Yoga 7Th Gen	-
Lenovo	Thinkpad X1 Yoga 6Th Gen Firmware	< 1.59
Lenovo	Thinkpad X1 Yoga 6Th Gen	-
Lenovo	Thinkpad X1 Yoga 5Th Gen Firmware	< 1.30
Lenovo	Thinkpad X1 Yoga 5Th Gen	-
Lenovo	Thinkpad X1 Yoga 4Th Gen Firmware	< 1.56
Lenovo	Thinkpad X1 Yoga 4Th Gen	-
Lenovo	Thinkpad X1 Titanium Firmware	< 1.24
Lenovo	Thinkpad X1 Titanium	-

Related Weaknesses (CWE)

CWE-20

References

https://support.lenovo.com/us/en/product_security/LEN-106014Vendor Advisory
https://support.lenovo.com/us/en/product_security/LEN-106014Vendor Advisory

FAQ

What is CVE-2022-4574?

CVE-2022-4574 is a vulnerability with a CVSS score of 6.7 (MEDIUM). An SMI handler input validation vulnerability in the BIOS of some ThinkPad models could allow an attacker with local access and elevated privileges to execute arbitrary code.

How severe is CVE-2022-4574?

CVE-2022-4574 has been rated MEDIUM with a CVSS base score of 6.7/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-4574?

Check the references section above for vendor advisories and patch information. Affected products include: Lenovo Thinkpad X13 Yoga Gen 2 Firmware, Lenovo Thinkpad X13 Yoga Gen 2, Lenovo Thinkpad X13 Yoga Gen 1 Firmware, Lenovo Thinkpad X13 Yoga Gen 1, Lenovo Thinkpad X13 Gen 3 Firmware.