CVE-2018-9084: System Management Module Vulnerabilities
Published Nov 27, 2018
·Updated
In System Management Module (SMM) versions prior to 1.06, if an attacker manages to log in to the device OS, the validation of software updates can be circumvented.
Affected Software
8 affected components
Lenovo System Management Module Firmware<1.06
Lenovo Thinkagile Hx Enclosure 7x81
Lenovo Thinkagile Hx Enclosure 7y87
Lenovo Thinkagile Hx Enclosure 7z02
Lenovo Thinkagile Vx Enclosure 7y11
Lenovo Thinkagile Vx Enclosure 7y91
Lenovo Thinksystem D2 Enclosure 7x20
Lenovo Thinksystem Modular Enclosure 7x22
Remediation
Information
Update SMM firmware
Event History
Nov 27, 2018
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
RemedyDescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2018-9084?
CVE-2018-9084 is classified as a medium severity vulnerability due to potential bypass of security controls.
2
How do I fix CVE-2018-9084?
To fix CVE-2018-9084, update the System Management Module firmware to version 1.06 or later.
3
Who is affected by CVE-2018-9084?
CVE-2018-9084 affects devices running versions of the System Management Module firmware prior to 1.06.
4
What impact does CVE-2018-9084 have on system security?
CVE-2018-9084 allows attackers with OS access to bypass software update validation, compromising system integrity.
5
Is there a workaround for CVE-2018-9084?
There is no known workaround for CVE-2018-9084, so updating the firmware is necessary to mitigate the risk.