CVE-2018-16091: System Management Module Vulnerabilities
Published Nov 27, 2018
·Updated
In System Management Module (SMM) versions prior to 1.06, the SMM certificate creation and parsing logic is vulnerable to several buffer overflows.
Affected Software
8 affected components
Lenovo System Management Module Firmware<1.06
Lenovo Thinkagile Hx Enclosure 7x81
Lenovo Thinkagile Hx Enclosure 7y87
Lenovo Thinkagile Hx Enclosure 7z02
Lenovo Thinkagile Vx Enclosure 7y11
Lenovo Thinkagile Vx Enclosure 7y91
Lenovo Thinksystem D2 Enclosure 7x20
Lenovo Thinksystem Modular Enclosure 7x22
Remediation
Information
Update SMM firmware
Event History
Nov 27, 2018
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
RemedyDescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2018-16091?
CVE-2018-16091 is considered to have a high severity due to its potential to exploit buffer overflow vulnerabilities.
2
How do I fix CVE-2018-16091?
To fix CVE-2018-16091, update the System Management Module firmware to version 1.06 or later.
3
What systems are affected by CVE-2018-16091?
CVE-2018-16091 affects the Lenovo System Management Module firmware versions prior to 1.06.
4
What are the risks associated with CVE-2018-16091?
The risks associated with CVE-2018-16091 include unauthorized access and potential arbitrary code execution due to buffer overflow vulnerabilities.
5
Is there a workaround for CVE-2018-16091 if I cannot apply the update?
There are no documented workarounds for CVE-2018-16091; applying the firmware update is the recommended solution.