Medium WID-SEC-2022-2136 23 CVEs

Lenovo BIOS: Mehrere Schwachstellen ermöglichen Privilegieneskalation

Published Feb 2, 2022 · Updated Oct 28, 2026 · Revision 6 · de-DE

Vendor: HP Vendor: Lenovo Vendor: NETAPP Product: AFF Product: BIOS Product: BIOS Product: FAS

Summary

Ein Angreifer mit physischem Zugriff kann mehrere Schwachstellen in Lenovo BIOS ausnutzen, um seine Privilegien zu erhöhen.

Product

Das BIOS ist die Firmware bei IBM PC kompatiblen Computern.

Vulnerabilities 23

Unscored —

CVE-2020-27339

In the kernel in Insyde InsydeH2O 5.x, certain SMM drivers did not correctly validate the CommBuffer and CommBufferSize…

Jun 16, 2021
Unscored —

CVE-2020-5953

A vulnerability exists in System Management Interrupt (SWSMI) handler of InsydeH2O UEFI Firmware code located in SWSMI …

Feb 3, 2022
Unscored —

CVE-2021-33625

An issue was discovered in Kernel 5.x in Insyde InsydeH2O, affecting HddPassword. Software SMI services that use the Co…

Feb 3, 2022
Unscored —

CVE-2021-33626

A vulnerability exists in SMM (System Management Mode) branch that registers a SWSMI handler that does not sufficiently…

Oct 1, 2021
Unscored —

CVE-2021-33627

An issue was discovered in Insyde InsydeH2O Kernel 5.0 before 05.09.11, 5.1 before 05.17.11, 5.2 before 05.27.11, 5.3 b…

Feb 3, 2022
Unscored —

CVE-2021-41837

An issue was discovered in AhciBusDxe in the kernel 5.0 through 5.5 in Insyde InsydeH2O. Because of an Untrusted Pointe…

Feb 3, 2022
Unscored —

CVE-2021-41838

An issue was discovered in SdHostDriver in the kernel 5.0 through 5.5 in Insyde InsydeH2O. There is an SMM callout that…

Feb 3, 2022
Unscored —

CVE-2021-41839

An issue was discovered in NvmExpressDxe in the kernel 5.0 through 5.5 in Insyde InsydeH2O. Because of an Untrusted Poi…

Feb 3, 2022
Unscored —

CVE-2021-41840

An issue was discovered in NvmExpressDxe in the kernel 5.0 through 5.5 in Insyde InsydeH2O. There is an SMM callout tha…

Feb 3, 2022
Unscored —

CVE-2021-41841

An issue was discovered in AhciBusDxe in the kernel 5.0 through 5.5 in Insyde InsydeH2O. There is an SMM callout that a…

Feb 3, 2022
Unscored —

CVE-2021-42059

An issue was discovered in Insyde InsydeH2O Kernel 5.0 before 05.08.41, Kernel 5.1 before 05.16.41, Kernel 5.2 before 0…

Feb 3, 2022
Unscored —

CVE-2021-42060

An issue was discovered in Insyde InsydeH2O Kernel 5.0 through 05.08.41, Kernel 5.1 through 05.16.41, Kernel 5.2 before…

Feb 3, 2022
Unscored —

CVE-2021-42113

An issue was discovered in StorageSecurityCommandDxe in Insyde InsydeH2O with Kernel 5.1 before 05.14.28, Kernel 5.2 be…

Feb 3, 2022
Unscored —

CVE-2021-42554

An issue was discovered in Insyde InsydeH2O with Kernel 5.0 before 05.08.42, Kernel 5.1 before 05.16.42, Kernel 5.2 bef…

Feb 3, 2022
Unscored —

CVE-2021-43323

An issue was discovered in UsbCoreDxe in Insyde InsydeH2O with kernel 5.5 before 05.51.45, 5.4 before 05.43.45, 5.3 bef…

Feb 3, 2022
Unscored —

CVE-2021-43522

An issue was discovered in Insyde InsydeH2O with kernel 5.1 through 2021-11-08, 5.2 through 2021-11-08, and 5.3 through…

Feb 2, 2022
Unscored —

CVE-2021-43615

An issue was discovered in HddPassword in Insyde InsydeH2O with kernel 5.1 before 05.16.23, 5.2 before 05.26.23, 5.3 be…

Feb 3, 2022
Unscored —

CVE-2021-45969

An issue was discovered in AhciBusDxe in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 bef…

Jan 5, 2022
Unscored —

CVE-2021-45970

An issue was discovered in IdeBusDxe in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 befo…

Jan 5, 2022
Unscored —

CVE-2021-45971

An issue was discovered in SdHostDriver in Insyde InsydeH2O with kernel 5.1 before 05.16.25, 5.2 before 05.26.25, 5.3 b…

Jan 5, 2022
Unscored —

CVE-2022-24030

An issue was discovered in AhciBusDxe in Insyde InsydeH2O with kernel 5.1 through 5.5. An SMM memory corruption vulnera…

Feb 3, 2022
Unscored —

CVE-2022-24031

An issue was discovered in NvmExpressDxe in Insyde InsydeH2O with kernel 5.1 through 5.5. An SMM memory corruption vuln…

Feb 3, 2022
Unscored —

CVE-2022-24069

An issue was discovered in AhciBusDxe in Insyde InsydeH2O with kernel 5.0 before 05.08.41, 5.1 before 05.16.29, 5.2 bef…

Feb 2, 2022

Revision history

2026-10-28 #6
Neue Updates von NetApp aufgenommen
2022-11-22 #5
Neue Updates von NetApp aufgenommen
2022-11-21 #4
Neue Updates von NetApp aufgenommen
2022-03-16 #3
Neue Updates von HP aufgenommen
2022-02-14 #2
Anpassung
2022-02-02 #1
Initiale Fassung

References

Lenovo Security Advisory vom 2022-02-02
http://support.lenovo.com/product_security/PS500463-INSYDEH2O-UEFI-SYSTEM-MANAGEMENT-MODE-SMM-VULNERABILITIES
HP Security Bulletin HPSBHF03778 vom 2022-03-17
https://support.hp.com/us-en/document/ish_5862767-5862793-16/HPSBHF03778
NetApp Security Advisory NTAP-20220216-0004 vom 2022-11-21
https://security.netapp.com/advisory/ntap-20220216-0004/
NetApp Security Advisory NTAP-20220216-0011 vom 2022-11-22
https://security.netapp.com/advisory/ntap-20220216-0011/
NetApp Security Advisory NTAP-20220216-0007 vom 2026-10-29
https://security.netapp.com/advisory/NTAP-20220216-0007