CVE-2020-8333 : A potential vulnerability in the SMI callback function used in the EEPROM driver

A potential vulnerability in the SMI callback function used in the EEPROM driver in some Lenovo Desktops and ThinkStation models may allow arbitrary code execution

Published 2020-09-24 21:15:16

Updated 2020-10-07 01:15:44

Source Lenovo Group Ltd.

View at NVD, CVE.org

Products affected by CVE-2020-8333

Lenovo » 63 Firmware
Versions before (<) fckt98a
cpe:2.3:o:lenovo:63_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » 63 » Version: N/A
Lenovo » H50-30g Firmware
Versions before (<) fckt98a
cpe:2.3:o:lenovo:h50-30g_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » H50-30g » Version: N/A
Lenovo » M4500 Firmware
Versions before (<) fckt98a
cpe:2.3:o:lenovo:m4500_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » M4500 » Version: N/A
Lenovo » Thinkcentre E73 Firmware
Versions before (<) fckt98a
cpe:2.3:o:lenovo:thinkcentre_e73_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkcentre E73 » Version: N/A
Lenovo » Thinkcentre E73s Firmware
Versions before (<) fckt98a
cpe:2.3:o:lenovo:thinkcentre_e73s_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkcentre E73s » Version: N/A
Lenovo » Thinkcentre E93 Firmware
Versions before (<) fbktdea
cpe:2.3:o:lenovo:thinkcentre_e93_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkcentre E93 » Version: N/A
Lenovo » Thinkcentre M4500k Firmware
Versions before (<) fckt98a
cpe:2.3:o:lenovo:thinkcentre_m4500k_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkcentre M4500k » Version: N/A
Lenovo » Thinkcentre M4500q Firmware
Versions before (<) fhkt85a
cpe:2.3:o:lenovo:thinkcentre_m4500q_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkcentre M4500q » Version: N/A
Lenovo » Yangtian Afh81 Firmware
Versions before (<) fckt98a
cpe:2.3:o:lenovo:yangtian_afh81_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Yangtian Afh81 » Version: N/A
Lenovo » Yangtian Mc H81 Firmware
Versions before (<) fckt98a
cpe:2.3:o:lenovo:yangtian_mc_h81_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Yangtian Mc H81 » Version: N/A
Lenovo » Thinkstation E32 Firmware
Versions before (<) fbktdea
cpe:2.3:o:lenovo:thinkstation_e32_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkstation E32 » Version: N/A
Lenovo » Thinkstation P300 Firmware
Versions before (<) a2kt70a
cpe:2.3:o:lenovo:thinkstation_p300_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkstation P300 » Version: N/A
Lenovo » Qitian 4500 Firmware
Versions before (<) fckt98a
cpe:2.3:o:lenovo:qitian_4500_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Qitian 4500 » Version: N/A
Lenovo » Qitian B4550 Firmware
Versions before (<) fckt98a
cpe:2.3:o:lenovo:qitian_b4550_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Qitian B4550 » Version: N/A
Lenovo » Qitian M4550 Firmware
Versions before (<) fckt98a
cpe:2.3:o:lenovo:qitian_m4550_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Qitian M4550 » Version: N/A
Lenovo » Thinkcentre M4500t Firmware
Versions before (<) fckt98a
cpe:2.3:o:lenovo:thinkcentre_m4500t_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkcentre M4500t » Version: N/A
Lenovo » Thinkcentre M4500s Firmware
Versions before (<) fckt98a
cpe:2.3:o:lenovo:thinkcentre_m4500s_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkcentre M4500s » Version: N/A
Lenovo » Yangtian Mf H81 Pci Firmware
Versions before (<) fckt98a
cpe:2.3:o:lenovo:yangtian_mf_h81_pci_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Yangtian Mf H81 Pci » Version: N/A
Lenovo » Yangtian Wf H81 Pci Firmware
Versions before (<) fckt98a
cpe:2.3:o:lenovo:yangtian_wf_h81_pci_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Yangtian Wf H81 Pci » Version: N/A
Lenovo » Yangtian Tc H81 Pci Firmware
Versions before (<) fckt98a
cpe:2.3:o:lenovo:yangtian_tc_h81_pci_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Yangtian Tc H81 Pci » Version: N/A
Lenovo » Yangtian Wcc H81 Pci Firmware
Versions before (<) fckt98a
cpe:2.3:o:lenovo:yangtian_wcc_h81_pci_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Yangtian Wcc H81 Pci » Version: N/A
Lenovo » Thinkcentre M9350z Firmware
Versions before (<) fekta2a
cpe:2.3:o:lenovo:thinkcentre_m9350z_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkcentre M9350z » Version: N/A
Lenovo » Thinkcentre M93z Firmware
Versions before (<) fekta2a
cpe:2.3:o:lenovo:thinkcentre_m93z_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkcentre M93z » Version: N/A
Lenovo » M4550 Firmware
Versions before (<) fckt98a
cpe:2.3:o:lenovo:m4550_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » M4550 » Version: N/A
Lenovo » Thinkstation C30 Firmware
Versions before (<) a3kt70a
cpe:2.3:o:lenovo:thinkstation_c30_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkstation C30 » Version: N/A
Lenovo » Thinkstation D30 Firmware
Versions before (<) a3kt70a
cpe:2.3:o:lenovo:thinkstation_d30_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkstation D30 » Version: N/A
Lenovo » Thinkstation S30 Firmware
Versions before (<) a2kt70a
cpe:2.3:o:lenovo:thinkstation_s30_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkstation S30 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2020-8333

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 10 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-8333

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.2	HIGH	AV:L/AC:L/Au:N/C:C/I:C/A:C	3.9	10.0	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
6.4	MEDIUM	CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H	0.5	5.9	Lenovo Group Ltd.
Attack Vector: Local Attack Complexity: High Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

References for CVE-2020-8333

https://support.lenovo.com/us/en/product_security/LEN-30042

Multi-vendor BIOS Security Vulnerabilities (June 2020) - US
Patch;Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2020-8333

Products affected by CVE-2020-8333

Exploit prediction scoring system (EPSS) score for CVE-2020-8333

CVSS scores for CVE-2020-8333

References for CVE-2020-8333