CVE-2022-4574 : An SMI handler input validation vulnerability in the BIOS of some ThinkPad model

An SMI handler input validation vulnerability in the BIOS of some ThinkPad models could allow an attacker with local access and elevated privileges to execute arbitrary code.

Published 2023-10-30 15:15:40

Updated 2023-11-08 00:24:33

Source Lenovo Group Ltd.

View at NVD, CVE.org

Vulnerability category: Input validationExecute code

Products affected by CVE-2022-4574

Lenovo » Thinkpad X1 Yoga 4th Gen Firmware
Versions before (<) 1.56
cpe:2.3:o:lenovo:thinkpad_x1_yoga_4th_gen_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad X1 Yoga 4th Gen » Version: N/A
Lenovo » Thinkpad L14 Firmware
Versions before (<) 1.20
cpe:2.3:o:lenovo:thinkpad_l14_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad L14 » Version: N/A
Lenovo » Thinkpad L15 Firmware
Versions before (<) 1.20
cpe:2.3:o:lenovo:thinkpad_l15_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad L15 » Version: N/A
Lenovo » Thinkpad X1 Fold Gen 1 Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_x1_fold_gen_1_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad X1 Fold Gen 1 » Version: N/A
Lenovo » Thinkpad X1 Titanium Firmware
Versions before (<) 1.24
cpe:2.3:o:lenovo:thinkpad_x1_titanium_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad X1 Titanium » Version: N/A
Lenovo » Thinkpad X13 Gen 2 Firmware
Versions before (<) 1.51
cpe:2.3:o:lenovo:thinkpad_x13_gen_2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad X13 Gen 2 » Version: N/A
Lenovo » Thinkpad X13 Yoga Gen 1 Firmware
Versions before (<) 1.45
cpe:2.3:o:lenovo:thinkpad_x13_yoga_gen_1_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad X13 Yoga Gen 1 » Version: N/A
Lenovo » Thinkpad X13 Yoga Gen 2 Firmware
Versions before (<) 1.40
cpe:2.3:o:lenovo:thinkpad_x13_yoga_gen_2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad X13 Yoga Gen 2 » Version: N/A
Lenovo » Thinkpad X1 Nano Gen 1 Firmware
Versions before (<) 1.55
cpe:2.3:o:lenovo:thinkpad_x1_nano_gen_1_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad X1 Nano Gen 1 » Version: N/A
Lenovo » Thinkpad T14s Gen 2 Firmware
Versions before (<) 1.51
cpe:2.3:o:lenovo:thinkpad_t14s_gen_2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad T14s Gen 2 » Version: N/A
Lenovo » Thinkpad T14s Firmware
Versions before (<) 1.26
cpe:2.3:o:lenovo:thinkpad_t14s_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad T14s » Version: N/A
Lenovo » Thinkpad T15 Gen 2 Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_t15_gen_2_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad T15 Gen 2 » Version: N/A
Lenovo » Thinkpad T15p Gen 1 Firmware
Versions before (<) 1.32
cpe:2.3:o:lenovo:thinkpad_t15p_gen_1_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad T15p Gen 1 » Version: N/A
Lenovo » Thinkpad T15g Gen 1 Firmware
Versions before (<) 1.32
cpe:2.3:o:lenovo:thinkpad_t15g_gen_1_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad T15g Gen 1 » Version: N/A
Lenovo » Thinkpad T14 Gen 1 Firmware
Versions before (<) 1.28
cpe:2.3:o:lenovo:thinkpad_t14_gen_1_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad T14 Gen 1 » Version: N/A
Lenovo » Thinkpad T14 Gen 2 Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_t14_gen_2_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad T14 Gen 2 » Version: N/A
Lenovo » Thinkpad P15v Gen 1 Firmware
Versions before (<) 1.32
cpe:2.3:o:lenovo:thinkpad_p15v_gen_1_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad P15v Gen 1 » Version: N/A
Lenovo » Thinkpad P17 Gen 1 Firmware
Versions before (<) 1.32
cpe:2.3:o:lenovo:thinkpad_p17_gen_1_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad P17 Gen 1 » Version: N/A
Lenovo » Thinkpad P14s Gen 1 Firmware
Versions before (<) 1.28
cpe:2.3:o:lenovo:thinkpad_p14s_gen_1_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad P14s Gen 1 » Version: N/A
Lenovo » Thinkpad P14s Gen 2 Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_p14s_gen_2_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad P14s Gen 2 » Version: N/A
Lenovo » Thinkpad P15 Gen 1 Firmware
Versions before (<) 1.32
cpe:2.3:o:lenovo:thinkpad_p15_gen_1_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad P15 Gen 1 » Version: N/A
Lenovo » Thinkpad P15s Gen 1 Firmware
Versions before (<) 1.28
cpe:2.3:o:lenovo:thinkpad_p15s_gen_1_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad P15s Gen 1 » Version: N/A
Lenovo » Thinkpad P15s Gen 2 Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_p15s_gen_2_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad P15s Gen 2 » Version: N/A
Lenovo » Thinkpad P1 Gen 3 Firmware
Versions before (<) 1.27
cpe:2.3:o:lenovo:thinkpad_p1_gen_3_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad P1 Gen 3 » Version: N/A
Lenovo » Thinkpad L15 Gen 2 Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_l15_gen_2_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad L15 Gen 2 » Version: N/A
Lenovo » Thinkpad L14 Gen 2 Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_l14_gen_2_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad L14 Gen 2 » Version: N/A
Lenovo » Thinkpad X1 Carbon 7th Gen Firmware
Versions before (<) 1.56
cpe:2.3:o:lenovo:thinkpad_x1_carbon_7th_gen_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad X1 Carbon 7th Gen » Version: N/A
Lenovo » Thinkpad X1 Carbon 8th Gen Firmware
Versions before (<) 1.30
cpe:2.3:o:lenovo:thinkpad_x1_carbon_8th_gen_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad X1 Carbon 8th Gen » Version: N/A
Lenovo » Thinkpad X1 Carbon 9th Gen Firmware
Versions before (<) 1.59
cpe:2.3:o:lenovo:thinkpad_x1_carbon_9th_gen_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad X1 Carbon 9th Gen » Version: N/A
Lenovo » Thinkpad X1 Extreme 3rd Gen Firmware
Versions before (<) 1.27
cpe:2.3:o:lenovo:thinkpad_x1_extreme_3rd_gen_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad X1 Extreme 3rd Gen » Version: N/A
Lenovo » Thinkpad X1 Yoga 5th Gen Firmware
Versions before (<) 1.30
cpe:2.3:o:lenovo:thinkpad_x1_yoga_5th_gen_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad X1 Yoga 5th Gen » Version: N/A
Lenovo » Thinkpad X1 Yoga 6th Gen Firmware
Versions before (<) 1.59
cpe:2.3:o:lenovo:thinkpad_x1_yoga_6th_gen_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad X1 Yoga 6th Gen » Version: N/A
Lenovo » Thinkpad X13 Firmware
Versions before (<) 1.26
cpe:2.3:o:lenovo:thinkpad_x13_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad X13 » Version: N/A
Lenovo » Thinkpad P1 Gen 4 Firmware » Version: 1.22
cpe:2.3:o:lenovo:thinkpad_p1_gen_4_firmware:1.22:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad P1 Gen 4 » Version: N/A
Lenovo » Thinkpad P1 Gen 5 Firmware
Versions before (<) 1.16
cpe:2.3:o:lenovo:thinkpad_p1_gen_5_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad P1 Gen 5 » Version: N/A
Lenovo » Thinkpad P14s Gen 3 Firmware
Versions before (<) 1.31
cpe:2.3:o:lenovo:thinkpad_p14s_gen_3_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad P14s Gen 3 » Version: N/A
Lenovo » Thinkpad P15 Gen 2 Firmware
Versions before (<) 1.25
cpe:2.3:o:lenovo:thinkpad_p15_gen_2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad P15 Gen 2 » Version: N/A
Lenovo » Thinkpad P15v Gen 2 Firmware
Versions before (<) 1.19
cpe:2.3:o:lenovo:thinkpad_p15v_gen_2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad P15v Gen 2 » Version: N/A
Lenovo » Thinkpad P15v Gen 3 Firmware
Versions before (<) 1.15
cpe:2.3:o:lenovo:thinkpad_p15v_gen_3_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad P15v Gen 3 » Version: N/A
Lenovo » Thinkpad P16 Gen 1 Firmware
Versions before (<) 1.17
cpe:2.3:o:lenovo:thinkpad_p16_gen_1_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad P16 Gen 1 » Version: N/A
Lenovo » Thinkpad P16s Gen 1 Firmware
Versions before (<) 1.31
cpe:2.3:o:lenovo:thinkpad_p16s_gen_1_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad P16s Gen 1 » Version: N/A
Lenovo » Thinkpad P17 Gen 2 Firmware
Versions before (<) 1.25
cpe:2.3:o:lenovo:thinkpad_p17_gen_2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad P17 Gen 2 » Version: N/A
Lenovo » Thinkpad T14 Gen 3 Firmware
Versions before (<) 1.31
cpe:2.3:o:lenovo:thinkpad_t14_gen_3_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad T14 Gen 3 » Version: N/A
Lenovo » Thinkpad T14s Gen 3 Firmware
Versions before (<) 1.33
cpe:2.3:o:lenovo:thinkpad_t14s_gen_3_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad T14s Gen 3 » Version: N/A
Lenovo » Thinkpad T15g Gen 2 Firmware
Versions before (<) 1.25
cpe:2.3:o:lenovo:thinkpad_t15g_gen_2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad T15g Gen 2 » Version: N/A
Lenovo » Thinkpad T15p Gen 2 Firmware
Versions before (<) 1.19
cpe:2.3:o:lenovo:thinkpad_t15p_gen_2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad T15p Gen 2 » Version: N/A
Lenovo » Thinkpad T15p Gen 3 Firmware
Versions before (<) 1.15
cpe:2.3:o:lenovo:thinkpad_t15p_gen_3_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad T15p Gen 3 » Version: N/A
Lenovo » Thinkpad T16 Gen 1 Firmware
Versions before (<) 1.31
cpe:2.3:o:lenovo:thinkpad_t16_gen_1_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad T16 Gen 1 » Version: N/A
Lenovo » Thinkpad X1 Carbon 10th Gen Firmware
Versions before (<) 1.37
cpe:2.3:o:lenovo:thinkpad_x1_carbon_10th_gen_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad X1 Carbon 10th Gen » Version: N/A
Lenovo » Thinkpad X1 Extreme 4th Gen Firmware
Versions before (<) 1.22
cpe:2.3:o:lenovo:thinkpad_x1_extreme_4th_gen_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad X1 Extreme 4th Gen » Version: N/A
Lenovo » Thinkpad X1 Extreme Gen 5 Firmware
Versions before (<) 1.16
cpe:2.3:o:lenovo:thinkpad_x1_extreme_gen_5_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad X1 Extreme Gen 5 » Version: N/A
Lenovo » Thinkpad X1 Nano Gen 2 Firmware
Versions before (<) 1.18
cpe:2.3:o:lenovo:thinkpad_x1_nano_gen_2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad X1 Nano Gen 2 » Version: N/A
Lenovo » Thinkpad X1 Yoga 7th Gen Firmware
Versions before (<) 1.37
cpe:2.3:o:lenovo:thinkpad_x1_yoga_7th_gen_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad X1 Yoga 7th Gen » Version: N/A
Lenovo » Thinkpad X13 Gen 3 Firmware
Versions before (<) 1.33
cpe:2.3:o:lenovo:thinkpad_x13_gen_3_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad X13 Gen 3 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2022-4574

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 6 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-4574

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.7	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	0.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
6.7	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	0.8	5.9	Lenovo Group Ltd.
Attack Vector: Local Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2022-4574

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Assigned by: psirt@lenovo.com (Secondary)

References for CVE-2022-4574

https://support.lenovo.com/us/en/product_security/LEN-106014

ThinkPad BIOS Vulnerabilities - Lenovo Support US
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2022-4574

Products affected by CVE-2022-4574

Exploit prediction scoring system (EPSS) score for CVE-2022-4574

CVSS scores for CVE-2022-4574

CWE ids for CVE-2022-4574

References for CVE-2022-4574