CVEvulnerability

CVE-2020-8332

6.4 MEDIUM Published 2020-10-14 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-10-14
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.4 MEDIUM — CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
6.4 MEDIUM — CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.9 MEDIUM — AV:L/AC:M/Au:N/C:C/I:C/A:C
Weaknesses
CWE-367

Description

A potential vulnerability in the SMI callback function used in the legacy BIOS mode USB drivers in some legacy Lenovo and IBM System x servers may allow arbitrary code execution. Servers operating in UEFI mode are not affected.

Affected configurations

• lenovo bladecenter hs23 firmware (< tke170b) • lenovo bladecenter hs23e firmware (< ahe172b) • lenovo compute node-x440 firmware (< cge128a) • lenovo flex system x220 firmware (< kse170b) • lenovo flex system x240 firmware (< b2e172b) • lenovo flex system x440 firmware (< cne172b) • lenovo nextscale nx360 m4 firmware (< fhe132b) • lenovo system x3300 m4 firmware (< yae166b) • lenovo system x3500 m4 firmware (< y5e170b) • lenovo system x3530 m4 firmware (< bee174b) • lenovo system x3550 m4 firmware (< d7e174b) • lenovo system x3630 m4 firmware (< bee174b) • lenovo system x3650 m4 firmware (< vve172b) • lenovo system x3650 m4 bd firmware (< vve172b) • lenovo system x3650 m4 hd firmware (< vve172b) • lenovo system x3750 m4 firmware (< a5e130a) • lenovo system x3750 m4 firmware (< koe170b) • lenovo idataplex dx360 m4 firmware (< tde168b) • lenovo idataplex dx360 m4 water cooled firmware (< tde168b)

Related

Weakness · CWE (1)

  • CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition weakness

References