CVE-2018-16094: System Management Module Vulnerabilities
Published Nov 27, 2018
·Updated
In System Management Module (SMM) versions prior to 1.06, an internal SMM function that retrieves configuration settings is prone to a buffer overflow.
Affected Software
8 affected components
Lenovo System Management Module Firmware<1.06
Lenovo Thinkagile Hx Enclosure 7x81
Lenovo Thinkagile Hx Enclosure 7y87
Lenovo Thinkagile Hx Enclosure 7z02
Lenovo Thinkagile Vx Enclosure 7y11
Lenovo Thinkagile Vx Enclosure 7y91
Lenovo Thinksystem D2 Enclosure 7x20
Lenovo Thinksystem Modular Enclosure 7x22
Remediation
Information
Update SMM firmware
Event History
Nov 27, 2018
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
RemedyDescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2018-16094?
CVE-2018-16094 is considered critical due to the potential for a buffer overflow leading to arbitrary code execution.
2
How do I fix CVE-2018-16094?
To fix CVE-2018-16094, update the System Management Module firmware to version 1.06 or later.
3
Which software is affected by CVE-2018-16094?
CVE-2018-16094 affects Lenovo System Management Module firmware versions prior to 1.06.
4
What are the consequences of CVE-2018-16094?
Exploitation of CVE-2018-16094 can lead to unauthorized access and control over affected systems.
5
Is my Lenovo hardware impacted by CVE-2018-16094?
Only those using Lenovo System Management Module firmware versions prior to 1.06 are impacted by CVE-2018-16094.